Security

Reporting a vulnerability

If you find a security issue, email TODO(nadeem): security contact address. Machine-readable details are at /.well-known/security.txt. Please give us time to fix it before you share it publicly.

Infrastructure

Powers4GA runs on Cloudflare Workers. Waitlist entries and accounts are stored in Cloudflare D1.

Accounts

Passwords are stored hashed, never in plain text. Sessions use a cookie the page's scripts can't read. Sign-up and sign-in are rate limited.

Your analytics data

Your analytics data lives in your own Google Analytics property, in your Google account. You can remove Powers4GA's access from your Google account at any time.