Security
Last updated: September 16, 2026
The short version. Traffic is encrypted, passwords are hashed by our sign-in provider, card numbers never touch our servers, and every database table has row-level access rules. Found a hole? Email security@wiredtype.com and we answer within five business days.
1. What we do
- Encryption in transit. Every page and API call uses HTTPS with HSTS. Plain HTTP redirects to HTTPS.
- Passwords. Sign-in is handled by Supabase, which stores passwords only as salted hashes. We never see or store a password. Minimum length is 8 characters, and password reset links expire.
- Payments. Stripe handles every card. Card numbers, security codes, and bank details never reach our servers; we keep only the product, amount, date, and Stripe's reference numbers.
- Database access. Row-level security is on for every table, so a signed-in person can reach only the rows the rules allow. The key that bypasses those rules exists only inside our server functions, never in the browser.
- Least data. AI chat messages and writing samples are not stored. Assessments taken without an account carry no name or email and are kept for no more than 12 months.
- Browser hardening. Pages send X-Frame-Options, nosniff, a referrer policy, a permissions policy, and a Content Security Policy that reports violations to us (report-only while we tune it, then enforced).
- Providers. Hosting, database, payments, email, and AI run on named providers, each listed in the Privacy Policy with what it receives.
- Backups. Our database provider keeps daily backups for 7 days. Deleted data can persist in a backup for up to 7 days and no longer.
2. Report a vulnerability
If you find a security problem, email security@wiredtype.com with the steps to reproduce it and the page or endpoint involved. Our contact details are also published at /.well-known/security.txt (RFC 9116).
What you can expect from us: an acknowledgment within five business days, a fix or a plan within 30 days for anything that puts user data at risk, credit here if you want it, and no legal action against good-faith research that follows the rules below. We do not run a paid bounty program.
What we ask of you: test only against your own accounts and data; do not read, change, or download other people's data beyond what is needed to show the problem exists; no denial of service, spam, or social engineering; give us a reasonable window to fix before you publish.
3. If something goes wrong
If we learn of a breach that affects your personal data, we will tell affected account holders by email promptly, say what was involved and what we did, and notify the authorities that the law requires (in New Jersey, the Division of State Police and, for a large breach, consumer reporting agencies under N.J.S.A. 56:8-163).
4. Acknowledgments
No outside reports yet. Researchers who report a real issue and ask to be named will be listed here.