Security you can read.
The code is open. Published pages are plain files.
AI agents
Agents act as you
They sign in as a person, and can do only what that person can.
Accounts are off limits
No agent can create tokens, change passwords or manage users.
Content is data
Text on a site is never treated as instructions.
Accounts
Argon2id
Passwords are hashed with it, and sign-in is rate limited.
Two-factor
With any authenticator app, and one-time recovery codes.
Roles
Give each person only the permissions they need.
Publishing
Plain files
Most requests never reach PHP or the database.
Nothing personal
A build renders as an anonymous visitor, so no session ends up in a page.
Uploads checked
Files are identified by their contents, and the public folder never runs PHP.
Found something?
A person reads every report.
1
You tell us
The affected version, and how to reproduce it.
2
We reply
We confirm what we found, and agree a date with you.
3
We fix it
The fix ships on its own, free for everyone.
4
We publish
We aim for 90 days at most, and credit you unless you’d rather we didn’t.