A deliberately small attack surface, described plainly so it can be checked.
Passwords are stored using Argon2id hashing and are never written to a log or an email. Sessions use a secure, HTTP only, host prefixed cookie, and the session identifier is regenerated on login.
Login, registration, password resets, posting, and reporting are all rate limited. Repeated failed logins slow down before they become useful to anyone.
Forum posts are stored and displayed as plain text. Poster HTML is never rendered, file uploads are not accepted, and every database query uses prepared statements.
Pages are served with a strict content security policy, framing is denied outright, and the browser is told not to guess content types.
The public document root contains one PHP file. All application code lives outside the web root, and the database credentials, application key, and mail settings sit in a protected configuration file that is never committed to source control.
Requests using methods other than GET, HEAD, POST, and OPTIONS are refused before they reach the application, as are dotfiles and source file extensions.
If you identify a security issue, do not test it against other members or public data, and do not attempt to access an account that is not yours.
Follow the instructions in the security.txt file and include enough detail for safe reproduction. Reports are read by the operator, not by a queue.
Use a unique password, protect the email account attached to your Forum login, and log out on shared devices.
Never include credentials, tokens, or client data in a post. Approved posts are public permanently.
The security contact and disclosure terms are published in the standard location.
