Security
Autoposter is pre-release, so this page describes the security posture of this website. It does not describe the product, which has no users, no data and no infrastructure yet. Claims about product security will appear here when there is a product to make them about.
What this site is
- Static HTML, CSS and JavaScript, built ahead of time and served from a CDN.
- No database, no user accounts, no sessions, no cookies.
- No analytics and no third-party scripts. Fonts, styles and scripts are all first-party, so the page renders fully with every external host blocked.
- One server-side endpoint,
/api/subscribe, which accepts an email address and forwards it to us. It stores nothing.
Headers
Responses carry a Content-Security-Policy that permits only same-origin
scripts, styles, fonts and connections, plus
X-Content-Type-Options: nosniff,
X-Frame-Options: DENY, a strict-origin referrer policy, and a
Permissions-Policy denying geolocation, camera, microphone and payment.
Secrets
The only secret this site holds is the API key used to send the waitlist notification. It exists as a server-side environment variable, is never included in any client bundle, and is not in version control.
Integrity
The landing page copy is hash-signed at build time and the digest is published on verify, so a reader can confirm the words have not changed since we signed them.
Reporting a vulnerability
Mail office@sftwrk.at with enough detail to reproduce the issue. We will confirm receipt within five working days. We run no bug bounty and cannot offer payment, but we will credit you if you want the credit.
We ask only that you avoid degrading the service for others and do not access data belonging to anyone else while testing.
Certifications
None. We are a small team and say so on the landing page: SOC 2 will be completed with our first enterprise partner, not before.