Security

This website

This marketing site has no accounts, no passwords, and no stored data. The only write path is the Contact form, which validates every field on the server before sending an email; nothing submitted through it is persisted here.

The OwnDocs product

Once you deploy OwnDocs, private (password-protected) mode uses signed sessions with an expiry and a fixed signing-algorithm allowlist, revokes a session on logout, and sends a header telling search-engine crawlers not to index the site. The built-in MCP server checks its access token with a constant-time comparison and validates every requested page path to block traversal outside the docs. The OpenAPI embed fetches remote specs through a fetcher built to resist server-side request forgery, with a size cap.

Reporting

Security disclosures: security@devops.bd