Security

Creators trust us with unfinished work, private material and, increasingly, income. This page describes how we protect it and how to tell us about a problem.

How we protect your account

Passwords of at least 10 characters with letters and numbers, checked in your browser and again by our servers.
Optional two-step verification with an authenticator app; once on, nothing in your account works until the code is entered.
Your password is asked for again before high-impact actions: deleting your account, transferring ownership, activating commercial licences, changing your password and issuing refunds.
A security history in Settings shows sign-ins, exports and other sensitive actions, and can be downloaded.

How we protect your data

Row-level security on every table: the database itself refuses to show one creator’s private data to another, whatever the app asks.
Private files are served through short-lived signed links; uploads are checked by content, size-limited and fingerprinted.
Links you paste are fetched through a guard that refuses private and internal network addresses.
Text from outside sources is fenced off before any AI sees it, so it can’t change instructions or settings.
Strict browser security headers (content security policy, HSTS, framing protection) and rate limits on every endpoint.
An append-only audit trail for security, privacy and financial events; financial and privacy entries can only be written by our servers.
Card and bank details are entered on Stripe or Razorpay’s own pages — they never touch our servers.

How we build

Every change goes through review and automated checks: tests of every database access rule, dependency audits, secret scanning and static security analysis.
Least-privilege service credentials, never sent to the browser.

Reporting a vulnerability

If you believe you’ve found a security problem, please tell us privately at connect@wonderapps.biz before sharing it with anyone else. Include what you found, how to reproduce it and what you think the impact is. We’ll acknowledge your report, keep you informed and credit you if you’d like.

Please don’t access, change or delete data that isn’t yours, degrade the service, or use social engineering.
Test only against your own accounts. We won’t pursue good-faith research that follows these rules.

Machine-readable contact: /.well-known/security.txt