Security

Last updated 11 September 2026.

This page lists the security controls Comment has today and the gaps that remain.

Data minimization

Comment does not capture typed input, passwords, pointer paths, or URL query strings. A report screenshot contains the page with the reporter’s marks. The full inventory is in the privacy notice.

What is captured is scanned before storage: email addresses, JSON web tokens, payment card numbers, and well-known API-key formats are masked, and a workspace can add its own deny-terms. The audit record says a value was removed and which rule removed it, never the value.

What we do

In transit and at rest

• HTTPS everywhere, with HSTS on the API and on this site.
• The database and object storage are managed services running in DigitalOcean's San Francisco region, on encrypted storage provided by them. We do not add a second layer of application-level encryption.
• API responses are marked no-store, framing is denied, MIME sniffing is off, and referrers are suppressed.

Accounts and access

• Passwords are hashed with argon2id (memory-hard parameters at or above current OWASP guidance) and must be at least 12 characters. Length is the only rule — composition rules push people toward worse passwords.
• Sessions are signed, HttpOnly, SameSite=Lax cookies, marked Secure in production, and they expire after 12 hours.
• Accounts are created by invitation only during early access, so there is no anonymous signup surface.
• Every query is scoped to one workspace and checked against your membership, so one customer cannot read another's data.

On your website

• The widget runs only on the origins you configure for that environment. A request from anywhere else is refused, and the refusal is recorded so you can see it happened.
• One script, from one origin. No third-party CDN, no font host, no tracker, and no cookie set on your domain.
• Installing it needs script-src and connect-src for our origin — not 'unsafe-inline'. This marketing site holds itself to the same standard: its own inline block is pinned by hash rather than allowed wholesale.

Abuse and evidence

• Public endpoints are rate-limited per IP, with a content-free security log.
• Reporter links carry a single-use code rather than an account, so a shared link does not become a standing credential.
• Uploaded files are content-addressed and private. They are served through a short-lived capability token, never a public bucket URL, and always as an attachment so nothing renders inline in a browser.
• Automated reproduction runs are bounded in time and cost, run without a live browser today, and are recorded for audit.

What we do not do yet

These items have no promised delivery date.

• No independent audit or certification. No SOC 2, no ISO 27001, no third-party penetration test, and no bug bounty programme.
• No SSO, SAML, SCIM, or two-factor authentication. Sign-in is an email address and a password.
• No remote session revocation. Signing out clears the cookie in that browser; a token that has already been issued keeps working until it expires, which is at most 12 hours.
• No EU region and no data-residency choice. Everything is in the United States. See the DPA for how that transfer is covered.
• No uptime commitment, status page, or on-call rotation, and no production error tracking or alerting yet. If the service is down at 3am, it is down until someone notices.
• Backups are the managed provider's; a restore has not been rehearsed. We do not offer a recovery-time or recovery-point commitment.
• Deletion runs on a schedule. A purge job runs in production about every 15 minutes. It enforces retention windows, removes uploads nobody attached to a report, and deletes stored files after their report is erased. Erasure removes the database record at once; the file itself goes on the job's next pass.
• No customer-managed encryption keys, and no self-hosting.

Reporting something

Email security@commentunderscore.com. Tell us what you found and how to see it; we will acknowledge within three working days and keep you posted until it is closed. We will not take legal action against anyone who reports a problem in good faith, tests only against their own account, avoids other people's data, and gives us a reasonable chance to fix it before going public.

If a breach affects your data, we will tell you without undue delay after we become aware of it, with what we know at the time. That commitment is written into the DPA rather than left as an intention.