Security

Payments

Checkout runs on Stripe, a PCI DSS Level 1 certified payment provider. Your card details go straight to Stripe and never touch our servers. We confirm payments only through messages signed by Stripe, and our server recalculates every price itself instead of trusting what the browser sends.

Your data

• The whole site is served over HTTPS, and browsers are told to always use HTTPS (HSTS).
• The database only exposes the public content of live buttons. Everything else, including buyer emails, is protected by row-level security and only reachable by our server functions.
• We store the minimum we need. See the Privacy Policy for details.

Accounts and access

• Buyers don’t need a password. Each button gets a private management link with a long random key, sent only to the buyer’s email. Keep it private, as anyone who has it can manage the button.
• The admin area uses one-time email sign-in links and only accepts a fixed list of team addresses.

Keeping the wall safe to click

• A person reviews every new button and every change before it goes live.
• We remove buttons that link to scams, malware or phishing, as our Terms of Use require.
• Links open in a new tab without giving the destination site access to this page.
• Our pages send security headers that block framing, content-type sniffing and unneeded browser features.

Report a vulnerability

If you believe you’ve found a security issue, email leonardt@outlook.com with a description, the steps to reproduce it and its impact. Please give us reasonable time to fix it before telling anyone else, and don’t access other people’s data, disrupt the service or run automated scans that degrade it. We’ll acknowledge your report and keep you updated. Our contact details are also published in security.txt.