Your choices about data
We use cookies that are required for this site to work. Anything beyond that — measuring how the site is used, or personalising what you see — happens only if you say yes.
Fail closed, and say so out loud.
The interesting part of a security
Report something
How a secret reaches a request
Four rules, each of which exists because the alternative bit someone.
01
Read on use, not on import
02
Never a default that silently works
03
Bearer instruments are hashed
04
Card data never reaches us
Questions we would want answered
Email us. There is no bounty programme and we will not pretend otherwise, but you will get a human reply and we will tell you what we did.
You are told, with what we know and when we knew it, including the parts that are unflattering. A disclosure that arrives late and polished is worse than one that arrives early and partial.
No third-party test has been commissioned. Saying so is more useful than a page that implies one by omission.