Security Policy

1.1Passwords must be at least 8 characters long, with upper- and lower-case letters, a number and a symbol, must not contain the username and must not be a known common password. They are stored only as Argon2 hashes, and no one on Staff has access to them.

1.2Changing or resetting the password ends sessions on every device, and you receive a notice by e-mail.

2.1You can turn on two-step verification with an authenticator app (TOTP). Secrets are encrypted at rest with AES-256-GCM, and recovery codes are shown only once and stored only as hashes.

2.2Turning two-step verification on or off triggers an e-mail notice.

3.1Sessions expire automatically and are checked on every request, so a suspension, deactivation or password change takes effect immediately.

3.2Repeated sign-in attempts lock the account temporarily, with increasing lockout times. Password recovery, sign-up and other sensitive routes are rate-limited per IP address. Codes sent by e-mail expire in 15 minutes and accept only a few attempts.

4.1Staff roles are hierarchical: moderators act only on regular accounts, and administrators on users and moderators. Nobody can act on their own account from the Staff console. “View as” is read-only, time-limited and audited.

4.2Every administrative action is recorded in an audit log, with author, date and time.

5.1All traffic uses HTTPS. The API sends strict security headers, does not let authenticated responses be cached and never exposes internal error details.

5.2Profile pictures and logos are loaded through our server, which validates the address, blocks internal networks, limits file size and type and never serves SVG.

5.3When you sign out, data saved for offline use is erased from the device.

6.1To keep your account secure:

1. use a password unique to Setlyst and a password manager;
2. turn on two-step verification and keep the recovery codes somewhere safe;
3. confirm your e-mail address, so you receive security notices and can recover the account;
4. sign out on shared devices;
5. be wary of messages asking for your password or codes: Setlyst never asks for them.

7.1If you have found a vulnerability, write to support@setlyst.app with the subject “Security”, describing the problem, its impact and the steps to reproduce it.

7.2While testing, we ask you to:

1. use only your own accounts or accounts created for the test;
2. not access, change or delete other people's data;
3. not perform denial-of-service tests, social engineering or spam;
4. stop testing and tell us as soon as you gain access to data that is not yours;
5. wait for the fix, or 90 days, before disclosing publicly.

7.3We acknowledge receipt within 5 business days and keep you informed about the fix. Setlyst will not take action against researchers for good-faith research carried out within these rules.