Security

• HTTPS only, with a 2-year HSTS policy on the domain and its subdomains (eligible for the browsers’ preload list).
• Encrypted connections (TLS required) between the application and the database; data at rest is encrypted by our hosting providers.
• A strict Content Security Policy: no script, style, font or network call to another domain in the dashboard; no page can be framed by another site (except the /embed widget and public shared dashboards).
• Isolation headers: Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Origin-Agent-Cluster, and a Permissions-Policy that denies camera, microphone, geolocation, payment, USB…

• Passwords hashed with scrypt, never stored or logged in clear. At least 10 characters, and refused when they appear in a known breach: we ask Have I Been Pwned with k-anonymity (only the first 5 characters of the SHA-1 hash leave our servers).
• Two-factor authentication (TOTP, RFC 6238) with any authenticator app, 10 single-use recovery codes (stored hashed), and replay protection: each code is accepted once.
• Sessions: a random 256-bit token of which only the SHA-256 hash is stored, in a __Host- cookie that is Secure, HttpOnly and SameSite=Lax. It ends after 14 days of inactivity and at most 30 days after sign-in, and is renewed at every sign-in and privilege change. You see and revoke each session from your account.
• Brute-force protection shared by all our servers: sliding-window rate limits and exponential lockouts per account and per network, with the same error message whether the account exists or not.
• Bot protection at sign-up (honeypot field, minimum fill time, per-network limits, optional Cloudflare Turnstile).
• A security log the account owner sees for 90 days (sign-ins, failures, two-factor, password, API keys, connected accounts), keeping only the truncated network (/24 for IPv4, /48 for IPv6), the browser and the country.

• Cookieless analytics: the tracker stores nothing on visitors’ devices, and IP addresses are never stored (visitor ids are hashed with a salt rotated daily).
• Hosted in the European Union: the application on Vercel (Dublin region), the PostgreSQL database on Supabase (Ireland).
• A dedicated least-privilege database role (not a superuser) that owns only the application’s schema, Row Level Security on every table, a schema not exposed through Supabase’s public API, and parameterized SQL only.
• Secrets are never stored in clear: API keys and session tokens hashed, TOTP seeds encrypted (AES-256-GCM), webhooks signed (HMAC).
• Database backups managed by our hosting provider, plus a manual export before any risky operation.
• Few, audited dependencies (npm audit); no third-party script in the dashboard.

Write to security@globatics.live (English or French) with the description, steps to reproduce, the impact, and how you’d like to be credited. We acknowledge within 3 business days, keep you posted, and fix as fast as the severity requires. Please give us 90 days (or until a fix ships) before publishing.

Rules

• Only test with your own accounts and sites; don’t access, change or keep other people’s data. If you come across some, stop and tell us.
• No denial of service, load testing, spam, social engineering or physical attacks.
• Out of scope: our providers’ services (Vercel, Supabase, Google), automated scanner reports without a demonstrated impact, a missing header without an exploit scenario, self-XSS.
• In scope: globatics.live and its subdomains, the tracking script, the API and the MCP server.

We don’t run a paid bug bounty yet; with your permission, we thank you publicly on this page.

If you act in good faith and follow this policy, we consider your research authorized: we won’t take or support legal action against you for it, and we’ll help if a third party does. This commitment can’t bind third parties or public prosecutors. You can also report a vulnerability to ANSSI, the French cybersecurity agency, which protects your identity (article L. 2321-4 of the French Defence Code).

This information is also published in the RFC 9116 format at /.well-known/security.txt.