Security

Access control

The dashboard and its API sit behind a signed login session — every request is verified server-side against a real cryptographic token, not just trusted because it came from the dashboard's domain. There's no shared admin password to leak or rotate.

Respondent edit links

Each submission gets a 256-bit random edit token. Only its SHA-256 hash is ever stored — the plaintext exists for one moment, in the submit response, and nowhere else. A token only ever grants access to the one submission it was issued for, and expires after the form's configured window.

Uploads

Files upload directly from the browser to storage — they never pass through our application servers. Before a submission can reference an uploaded file, we check the real bytes against the claimed type (not just the content-type header the browser sent) and re-check the size limit.

Bot and abuse protection

Every submission is checked with invisible human-verification before it's accepted. Submissions and uploads are also rate-limited per visitor and per form.

Webhook secrets

A webhook's signing secret is generated randomly, encrypted at rest, and shown to you exactly once, at creation. We can't show it to you again — if you lose it, rotate the webhook. Destination URLs are checked and rejected if they'd point at an internal address, a cloud metadata endpoint, or anywhere else outside the open internet, both when you add the webhook and again every time we deliver to it.

Cross-origin requests

A form only accepts browser requests from the origins you've explicitly allowed for it — never a wildcard, never a reflected "any origin" response.

Reporting an issue

Found a security problem? We take reports seriously — a dedicated contact will be published here before public sign-ups open.