Legal
Security
Transport security
All traffic between clients and SocialWeb servers is encrypted with TLS 1.2 or 1.3. Plaintext HTTP connections are redirected to HTTPS. HSTS is enforced with a long max-age directive.
Security headers
Every response from socialweb.cloud includes a strict Content Security Policy, X-Frame-Options: DENY (preventing clickjacking), X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy restricting access to sensitive browser APIs.
This website makes no third-party network requests. You can verify this in your browser's Network panel.
Authentication
Passwords are hashed using a modern, salted hashing algorithm before storage. We do not store plaintext passwords. Authenticated sessions use signed, httpOnly cookies.
We do not currently offer two-factor authentication for the managed cloud product, but it is on the roadmap.
Infrastructure
SocialWeb's managed cloud runs on DigitalOcean infrastructure in a dedicated environment. Access to production systems is restricted to authorized personnel and requires key-based authentication.
Self-hosted instances are entirely under the control of the operator. We do not have access to self-hosted data or infrastructure.
Data minimization
We collect as little personal data as possible. RSS feed fetching and search proxying are handled server-side so that publishers and search providers see SocialWeb's IP addresses, not yours. We do not log which articles you read. See the Privacy Policy for full details.
Dependency and patch management
We use automated tooling (Dependabot) to track and apply security updates to our dependencies. Critical patches are applied promptly. Our CI pipeline runs on every change.
Responsible disclosure
If you discover a security vulnerability in SocialWeb, please report it privately before disclosing publicly. We take all reports seriously and will respond within 48 hours of receipt.
We ask that you: give us reasonable time to investigate and remediate before public disclosure; avoid accessing, modifying, or deleting data that isn’t yours; and not use the vulnerability to disrupt service to other users.
In return, we will: acknowledge your report promptly; keep you informed of our progress; credit you in our disclosure (if you wish); and not pursue legal action for good-faith research conducted under this policy.
Scope
In scope: socialweb.cloud and its subdomains, the SocialWeb mobile apps, and the SocialWeb open-source server software.
Out of scope: self-hosted instances operated by third parties, third-party services we depend on (DigitalOcean, Resend), and social-engineering or phishing attacks targeting our team.