Security
How ProofPack protects evidence and accounts.
Principles
- Full serial numbers, identity documents and payment details are never shown publicly.
- Frozen versions cannot be edited; corrections always create a new version.
- Private media is served through short-lived signed URLs, not public files.
- Sensitive actions are rate-limited and logged without storing sensitive content.
Technical measures
- Server-side validation on every mutation.
- Public codes drawn from a restricted, non-sequential alphabet.
- Expiring challenge codes with limited attempts.
- Security headers and a restrictive content security policy.
- MIME-type and size validation on uploads.
Report a security issue
If you believe you have found a vulnerability, contact us before disclosing it publicly.