Security

Reporting a vulnerability

If you find a security issue, email support@powers4ga.com. Please give us time to fix it before you share it publicly.

Machine-readable details are at /.well-known/security.txt.

Infrastructure

Powers4GA runs on Cloudflare Workers. Accounts and settings are stored in Cloudflare D1, and report results are cached for 30 minutes or less.

All traffic uses HTTPS.

Accounts

Passwords are stored hashed. Sessions use a cookie that page scripts can't read, and sign-up and sign-in are rate limited.

Google sign-in asks only for your name, email and photo. It never merges into a password account whose email we haven't verified.

Google Analytics access

Google refresh tokens are encrypted, and never sent to your browser. Your analytics stay in your own Google Analytics property.

You can remove Powers4GA's access in your Google account permissions at any time.

Revenue tracking

Measurement Protocol secrets and webhook signing secrets are encrypted. We check the signature on every payment webhook, and drop any that don't match.

Error reports

We use Sentry to catch errors. Session replays hide on-screen text, form inputs, images and media.