Security policy

What to include

• The affected page, feature or endpoint, and when you observed the issue. Include the browser, client or version if relevant.
• Clear reproduction steps using your own test account and synthetic data; include expected and observed behaviour.
• The possible impact and any minimal, redacted screenshots or technical evidence needed to understand it.
• Exclude passwords, access tokens, session cookies, private keys and real customer records. Share only the minimum information needed.

How we protect Bibleit

• Web connections use HTTPS, and production database connections verify TLS certificates.
• Passwords use salted Argon2id hashes. Application-issued bearer tokens and sessions are verified against stored hashes. Personal tokens expire within 90 days. Only organization tokens can use No Expiration; they remain subject to revocation, selected permissions and organization access controls.
• Database, media and backup volumes use Fly-managed encryption keys. Authorized application processes can read data to provide the service.
• Scheduled backups and isolated restore checks support recovery. Restore procedures reapply the erasure register to remove previously deleted data.

Test responsibly

Use only accounts and resources you own or are explicitly authorized to test. Do not disrupt the service, send spam or run load tests without prior agreement.

If you unexpectedly encounter someone else’s information, stop testing and report the location without copying, changing or distributing that information.

Keep reports private while we investigate. Please coordinate any public disclosure after we have had an opportunity to address the issue.

Handling your report

We use your report to investigate and respond. Avoid sensitive personal information and unnecessary attachments.

For privacy-rights requests, you can use the same email address. For general product help, visit Support.