Stories · Characters · Dialogue
Security is a practice, not a badge.
This page describes protections implemented in this revision, dated . It does not claim an independent penetration test, compliance certification or complete protection from every vulnerability.
Implemented protections
The app uses hosted HTTPS, ChatGPT identity for Community writes, server-side ownership and moderator checks, parameterized database queries, request-size limits, rate limits and cross-site request checks. Browser response policies restrict scripts, embedded content and unnecessary device permissions. Uploaded pictures are size-, signature- and dimension-checked; active SVG uploads are not accepted.
Your own copies matter
Unpublished drafts are browser-local, not automatically synced or encrypted by a profile PIN. Export backups before changing devices or clearing browser data. Publishing is public and noindex is not secrecy. Provider session behavior, external caches and retention have limits that the app cannot guarantee.
Report a problem responsibly
Use Contact and choose Security vulnerability. Describe the affected page, impact and a minimal reproduction with your own fictional data. Do not access other writers' content, send secrets, or run disruptive tests. No bounty or response-time promise is offered.
Maintenance transparency
The source includes automated API, ownership, upload, backup and public-page tests. Documentation changes are dated and deployment is reviewed by the operator. An independent audit, public uptime commitment, automated external backup destination and guaranteed maintenance schedule are not currently established.