Security

I keep a closer eye on this than the rest of the site lets on.

People try things here. That's expected, and for one particular part of this site, it's the whole point. This page is about what actually happens when they do, said plainly, not as a warning.

What's actually protected

Certain things about how this company runs underneath its own products are never going to reach you through a reply, no matter how the question is phrased, no matter how patient or clever the attempt. That's not a policy I've asked politely for. It's enforced the same way every time, independent of what any single conversation says, and it does not degrade under pressure the way a instruction alone would. I'll leave it at that. Saying more about the mechanism would defeat part of the point.

What's deliberately not protected

One part of this site, the correspondence panel, is built to be genuinely tested. If you find a way to get it to say something it shouldn't, in character, that's not a security failure, that's the product working as intended, and I'd rather you enjoyed finding it than felt bad about trying. What it will never do, no matter how far that goes, is hand you the one thing actually being protected above. Those are two different locks, and only one of them is meant to hold every time.

What gets watched, and logged

• Messages that look like an attempt to manipulate a product into breaking its own rules get noticed and recorded, quietly, for my own review, not acted on in the moment beyond what the product itself does.
• Messages showing real signs of crisis are detected before a reply is generated at all, and that detection doesn't depend on which product you're talking to.
• A real daily limit per connection stops a script from running up a bill at my expense, backed by shared storage, not just something a browser could clear its way past. It's not elaborate. It doesn't need to be, yet.

More detail on what that logging actually contains is on the privacy page, not repeated here.

If you find something real

A genuine vulnerability, something that actually exposes data, breaks the infrastructure, or gets past the one lock that's supposed to hold every time, is worth telling me about directly. Use the correspondence panel on the homepage and say plainly that it's a security report. I read that panel myself, and I'll treat a real finding seriously and won't come after you for having looked. What I'd ask in return: don't publish it before I've had a real chance to respond, and don't go further than necessary to prove the thing is real.

What I won't do

I'm not going to pretend this is invulnerable. Nothing running on rented infrastructure with a public API surface honestly can claim that, and a security page that claims otherwise isn't one worth trusting. What I can say is that the one thing built to hold, holds the same way every time, by construction, not by hoping the conversation goes well.

This page describes intent and outcome, not implementation. That's on purpose too.