Code review, vulnerability checks, and penetration testing
Authentication, permissions, remote fetches, payment events, and data deletion are security-sensitive change areas. Their implementation and regression checks are part of assessing a release. Dependencies and provider integrations also need review when advisories or behavior changes affect them.
Penetration testing is a separate assurance activity with a named scope, date, methodology, and remediation status. Request any applicable assessment and its coverage through the security documents channel. This overview does not supply a dated external penetration-test report or imply that automated tests replace one.
Validate at the boundary
Requests are checked where they enter the service. Sensitive account and administrative operations require authorization on the server. Payment and provider events are validated before they change account or processing state.
Changes with checks
The codebase includes automated tests for authentication, authorization, request validation, provider integration, and privacy related behavior. Targeted checks support review of changes to these areas.
Responsible disclosure
If you find a security issue, send a concise description, affected URL, and reproducible steps. Avoid collecting another person's data or interrupting the service while investigating. We use the information to reproduce and assess the issue.