Security

• An external identity provider handles sign-in, verified email, and multi-factor authentication.
• Team membership, role, and token scope are checked for protected requests.
• API tokens use random values. Stazus stores token hashes and shows a raw token only when it is created.
• Sensitive endpoint configuration uses authenticated encryption at rest and is not returned to the browser after storage.
• Network controls block private, link-local, and metadata destinations to reduce server-side request forgery risk.
• Request limits, strict input validation, audit records, dependency scans, and release scans protect service boundaries.
• Encrypted backups have integrity checks and documented restore procedures.

Security controls reduce risk. They cannot guarantee that a service will never fail or be compromised.

• Enable a strong sign-in method and multi-factor authentication.
• Give each automation client a separate, least-privilege token.
• Set token expiry and revoke tokens that are no longer needed.
• Do not put secrets in ordinary text fields.
• Review team membership, roles, and notification destinations.
• Monitor only destinations that you own or can lawfully test.

Email contact@jdqc.dev with the subject Stazus security report. Include the affected area, reproduction steps, impact, and a safe contact method. Do not include working credentials or personal data in the first message.

Give us reasonable time to investigate and correct a confirmed issue before public disclosure. We will coordinate status and disclosure timing with the reporter when possible.

Use only accounts and systems that you own or have permission to test. Stop if you access another person's data. Do not use denial of service, social engineering, malware, destructive actions, automated high-volume scanning, or persistence.

A security report does not create a promise of payment. Agree on any bounty in writing before you start work that expects payment.

We investigate suspected security incidents, preserve relevant evidence, contain confirmed issues, and restore affected services. We will notify affected users and authorities when law or material risk requires notification.