Security

Report a problem

If you find a security problem, email adham@barakatlabs.com with what you found and how to reproduce it. We read every report and will reply. Please give us a reasonable time to fix it before you share it, and do not access other people's data. Our contact details are also in security.txt.

How the calculators are kept safe

• No cookies, no stored sign-in and no stored data on the device, so there is nothing to steal from a calculator.
• The calculator pages are the only pages that can be shown inside another site's page, because that is their purpose. Every other page refuses to be framed.
• Settings in the address (accent color, logo, theme) are checked strictly. Anything unexpected falls back to the default and never reaches the page.
• The embed script sizes its frame only from messages sent by its own frame, and clamps the size.
• A Content-Security-Policy and the usual security headers are on every page.
• Signups go through a bot check, a hidden trap field and a rate limit that stores only scrambled codes.
• Secrets are kept in the host's settings, never in the code, and never written to logs.