Security

In transit

• Every page and API is served over HTTPS. Plain http is sent to https in one step.
• HSTS is on for one year, including subdomains.
• Pages carry a strict Content Security Policy with a new nonce for every response, and cannot be framed by other sites.

Accounts

• Passwords are hashed with PBKDF2. New passwords are checked against known breaches with Have I Been Pwned, which only ever sees part of a hash.
• Session tokens are stored only as SHA-256 hashes. The cookie is HttpOnly, Secure and SameSite=Lax.
• Every form is protected against cross-site request forgery.
• Sign-in, sign-up and password reset are rate limited.

Keys and tokens

• Meta access tokens are encrypted before they are stored, with a key kept as a Cloudflare secret.
• Our own API keys live in Cloudflare secrets, never in code.
• Each site's Events API key can be replaced at any time, and the old one stops working.

Short links

• Only signed-in users with a confirmed email can make links.
• Every destination is checked with Google Safe Browsing and against a list of other shorteners, and checked again at least daily.
• Link creation is rate limited per account.
• The short link host only redirects. It never serves pages, files or a sign-in form, and the destination always comes from our database, never from the request.
• We can turn off any link or account that is misused.

Visitor data

• Visitor IP addresses are never stored.
• The salt behind visitor hashes is replaced daily and the old one deleted.
• Emails and phone numbers sent with the Events API are kept only as SHA-256 hashes.

Where it runs

Sporetag runs on Cloudflare Workers, with data in Cloudflare D1 and Workers Analytics Engine. Payments are handled by Stripe.

Report a problem

If you find a security issue, email hello@sporetag.com. Please give us time to fix it before you share it. We will reply, keep you posted and thank you. Our contact details are also in security.txt.