Security
We take responsible disclosure seriously. If you believe you have found a vulnerability in Hook Anatomy, please contact us before disclosing it publicly, and give us a reasonable window to ship a fix.
Reporting a vulnerability
Contact
Placeholder address — replace with the production security contact before launch. The full policy lives in SECURITY.md at the repository root.
Please include reproduction steps, affected URLs, and the impact you believe the issue has. We will acknowledge receipt and keep you updated through remediation.
How accounts are protected
- Passwords are hashed with Argon2id — never stored or logged in readable form
- Sessions are signed JSON Web Tokens with server-side revocation, so logging out invalidates the token immediately
- Workspace data is scoped per organization, and every privileged action is written to an audit log
- Payments run through Stripe Checkout; card details never touch our servers
Out of scope
Please do not run automated scanners against production, attempt denial of service, or access data belonging to accounts other than your own. Testing that degrades the service for other users is not authorized.