Security

Found a vulnerability? Email hello@tinkertown.co with steps to reproduce. Please give us 90 days before public disclosure, don't access other people's data, and don't run denial-of-service tests. We'll acknowledge within 3 business days.

How we protect data

• OAuth 2.1 with PKCE; tokens bound to this server (RFC 8707); short-lived access tokens; rotating refresh tokens with reuse detection
• Tokens, codes and session ids are stored only as SHA-256 hashes
• Strict per-user data separation; no chat-history access
• HTTPS only in production