Payments
Stripe processes every payment inside Stripe-hosted fields. Card numbers, wallet and Klarna credentials never reach our servers; we receive only the checkout status and identifiers. Each checkout session is verified server-side against the live Stripe catalog before fulfillment, and webhook events are signature-checked and processed exactly once.
Accounts and access
Authentication runs on Supabase with hashed passwords, a minimum length of 8, and a check against known breached-password lists. Every quiz and content request is authorized on the server against your entitlements, never from the browser alone. Admin tools are restricted to named owner accounts. Password reset and checkout endpoints are protected by Vercel BotID and same-origin request checks.
Infrastructure
The site is served over HTTPS only with a content-security policy, and hosted on Vercel with the database on Supabase. Sentry captures errors with session replay that masks all text and blocks media; replays are kept for 30 days. Server logs are kept for up to 90 days. Secrets live in the hosting platform's encrypted configuration, never in the repository.
Responsible disclosure
If you believe you have found a vulnerability, email support@que-bank.com with the subject "Security" and enough detail to reproduce it. We acknowledge reports within 3 business days, keep you informed while we fix the issue, and credit you if you wish. We will not take legal action against good-faith research that stays within this scope:
- Test only against your own account and data. Do not access, modify or download other users' data.
- No denial-of-service, spam, social engineering, or physical attacks.
- Do not use automated scanners at volumes that degrade the service.
- Give us a reasonable time to fix the issue before any public disclosure.
Machine-readable contact details are published at /.well-known/security.txt.
Your part
Use a unique password, keep your email account secure, and sign out on shared devices. If you think your account was accessed by someone else, change your password in Settings and contact us. See also the Privacy Policy.