Security

If you believe you have found a security problem, email fedorlipskerov@gmail.com with enough detail to reproduce it. We will acknowledge within three working days.

Please do not run automated scanners against the production service, access or modify data that is not yours, or degrade the service for other users. Report in good faith and give us reasonable time to fix the issue before disclosing it, and we will not pursue action against you.

• Passwords are hashed with Argon2id at the OWASP-recommended parameters, with a unique salt per password. They are never stored or logged in a readable form.
• Sign-in is protected by rate limiting on both the address and the source address, and repeated failures lock an account for an escalating period.
• Registration, sign-in and password reset all give the same answer whether or not an address is known, so the service cannot be used to discover who has an account.
• Password reset and email confirmation links are single-use, stored only as a hash, and expire.

• Signing in issues an opaque random token in an httpOnly, Secure cookie. Only a hash of it is stored, so a leak of the database does not hand over live sessions.
• Changing your password immediately revokes every other session, which is the point of changing it.
• State-changing requests carry a CSRF token that another site cannot read or forge.

• All traffic is served over HTTPS with certificates renewed automatically. HSTS is set with a long max-age, so browsers refuse to fall back to plain HTTP.
• Responses carry a content security policy and the usual protective headers — no framing, no content-type sniffing, a restrictive referrer policy, and browser features such as camera, microphone and location switched off.
• The application connects to its database as a least-privilege role that can read the analytics data and read and write application data, with no schema or administrative rights. A flaw in a query is a bad read, not a takeover.
• The database is not reachable from the public internet.
• Containers run as a non-root user.

Card details never reach Trialytic. Payment is handled by Lemon Squeezy as merchant of record, and the webhook that tells us your subscription changed is verified by signature before it is trusted.

Programmatic keys are shown once at creation and stored only as a hash. Each key carries a per-plan daily request budget and page-size limits. Delete a key from your account page and it stops working immediately.

Application data — accounts, subscriptions and your saved content — is backed up on a nightly schedule, with restores exercised rather than assumed. The much larger public-record dataset is rebuildable from its sources.

Trialytic is an early-stage product run by a small team. We hold no SOC 2 or ISO 27001 certification and have not commissioned a third-party penetration test. We would rather say so plainly than imply assurances we do not have. If your procurement process needs either, write to us and we will tell you honestly where we stand.