Security

The site

AutoStacc is only served over HTTPS, and browsers are told never to use a plain connection to it. Account pages only run AutoStacc's own code. Creators' Studio pages can't run any code a creator wrote: the only script they load is AutoStacc's own, for slideshows, tabs, countdowns and the like, and it makes no requests of its own. A creator's own styles are checked and kept inside their page, so they can't cover AutoStacc's strip or pretend to be AutoStacc.

Accounts and passwords

Passwords are at least 10 characters and are stored only as a one-way hash. You must confirm your email before an account can sign in. Repeated sign-in attempts are slowed down. Changing or resetting your password signs out your other devices, and reset links work once, for an hour.

Payments

Card details are entered on Stripe's checkout page and never reach AutoStacc. Prices and payment results come from the store and Stripe, never from your browser.

Your files

Paid files are never public. A download link is made for your purchase when you ask for it, works only for you, and expires after a few minutes. Your library only shows what you own.

Keeping your account safe

• Use a password you don't use anywhere else.
• Check Settings › Security for devices you don't recognise, and sign them out.
• AutoStacc will never ask for your password by email.

Reporting a security problem

If you find a vulnerability, please report it privately before telling anyone else, with enough detail to reproduce it. Don't access other people's data, and stop as soon as you've shown the problem exists. Email [email protected].