Security
Security
How we protect your account, and how to tell us if you find a problem.
How accounts are protected
No passwords to steal
You sign in with a link we email you. Each link works once, for 15 minutes.
See where you're signed in
Account settings lists every browser signed in to your account, and you can sign any of them out.
Encrypted in transit
Every page and request is served over HTTPS.
Changes are confirmed
Changing your email sends a confirmation to the new address and a notice to the old one, with a way to undo it.
Report a vulnerability
If you believe you've found a security problem, please tell us privately before sharing it with anyone else. Include what you found, how to reproduce it, and how we can reach you.
Please don't access, change or delete other people's data, and stop as soon as you've confirmed a problem. We'll acknowledge your report and keep you updated while we fix it.