Security posture

Small static attack surface, explicit file trust boundaries.

Implemented controls

No research API, research account, project server database, project telemetry or remote AI. Billing alone loads a payment SDK and contacts declared checkout hosts.
Restrictive content security policy and response headers in prepared releases.
Strict JSON parser rejects duplicate keys, unsafe prototype keys, unsupported numeric values, trailing content, and oversize files.
Schema validation rejects unknown fields, invalid IDs, impossible timestamps, mismatched editions, repeated cards/groups, and limit violations.
SHA-256 fingerprints bind frozen editions; SHA-256 digests bind response and checkpoint payloads.
HTML/SVG escaping, spreadsheet-formula neutralization, and safe filename generation protect exported artifacts.
IndexedDB writes use expected revisions; Web Locks reduce simultaneous-writer risk where supported.
Public releases include a manifest, SHA-256 checksums, security headers, and a security contact.

What integrity digests do not do

A digest detects accidental or deliberate payload changes after creation. It does not authenticate the participant, prove who created a file, encrypt content, establish consent, guarantee malware-free surrounding storage, or stop an authorized holder from copying the file.

User-controlled risk

Researchers control card text, study information, notes, response files, export destinations, devices, backups, transfer channels, and retention. Use encrypted and managed endpoints where appropriate, limit folder access, avoid direct identifiers, verify recipients, and follow organizational incident procedures.

Report a vulnerability

Email socialreminderinfo@gmail.com with a concise description, affected version/URL, reproduction steps, and impact. Do not include live participant data, exploit unrelated systems, cause disruption, or publish details before a reasonable remediation window. The prepared release also publishes /.well-known/security.txt.

Out of scope

General UX feedback, unsupported old browsers, user-authored research content, lost local files, compromised devices, hosting-provider availability, and legal/compliance questions are not vulnerabilities in the static runtime, though support may still document them.

No security guarantee: these controls reduce selected risks. They do not promise that the product, host, browser, device, transfer channel, or research process is secure for every threat model.