$ cat /security.md

Security at whomi.bio

whomi.bio connects to your public developer accounts and carries work enquiries, so we treat account and data protection as a core feature — not an afterthought. Here is exactly how it works, in plain English.

>_Account & authentication

Passwords are never stored in plain text — they are hashed with bcrypt before they touch the database.
Sessions use short-lived JSON Web Tokens delivered in httpOnly, Secure cookies, so scripts running in the page can't read them.
GitHub sign-in uses standard OAuth — we never see or store your GitHub password.
Administrative access additionally requires TOTP two-factor authentication.
You can invalidate every active session for your account at any time from the revoke link in our security emails.

>_Encryption & data handling

All traffic to whomi.bio is served over HTTPS (TLS). Plain-HTTP requests are redirected.
Live widget data (GitHub, Stack Overflow, LeetCode, npm) is fetched from public read-only APIs — we only request data those platforms already publish about you.
Payment card details never touch our servers: card payments are processed by Stripe and crypto payments by crypt.pe. We store only the resulting subscription/entitlement state.
Transactional email is delivered through Resend. Product analytics use PostHog and Google Analytics.

>_Data retention & deletion

Your profile data exists for as long as your account does. Deleting your account removes your public profile, links, enquiries and uploaded files from production systems.
Details of what we collect and your rights under GDPR are documented in the Privacy Policy and Data Processing Addendum.

>_Incident response

If we become aware of a security incident affecting your data, we will investigate, contain it, and notify affected users without undue delay, consistent with applicable law.
Platform health is published openly on the status page.

>_Responsible disclosure

Found a vulnerability? We want to hear about it before anyone else does. Email security@whomi.bio with reproduction steps and impact. We will acknowledge your report, keep you informed while we fix it, and credit you if you'd like. Please give us reasonable time to remediate before public disclosure, and don't access data that isn't yours while testing.

In scope: whomi.bio and its API. Out of scope: third-party services we integrate with (report those to the respective vendor), volumetric denial of service, and social engineering.