Security
How CompassPad handles accounts and data, and how to report a vulnerability.
Last updated September 2026
Accounts
Passwords are stored as a salted hash, never in plain text. Sessions are held in a signed cookie and are invalidated when you sign out. Administrative actions require an account with the admin role.
Abuse prevention
Votes are limited to one per visitor per listing and are rate-limited by a hashed request identifier. Comments require a signed-in account. Submissions are rate-limited and reviewed by a person before publishing.
Reporting a vulnerability
If you believe you have found a security issue, email us with the steps to reproduce it. Please give us a reasonable window to fix the issue before disclosing it publicly. We will acknowledge your report and tell you when it is resolved.