Security & Vulnerability Disclosure

At CineLog (https://cinelog.fyi), safeguarding your privacy and protecting account integrity is our top priority. We implement defense-in-depth engineering practices to secure application infrastructure and user data.

Cryptographic Password Hashing: User passwords are never stored in plaintext. Passwords are salted and hashed using bcrypt before being persisted.

Secure Session Management: Authentication tokens are stored in httpOnly, SameSite=Lax, Secure cookies, shielding them from client-side script access and mitigating Cross-Site Scripting (XSS) extraction.

Transport Layer Security (TLS): All data exchanged between your browser and CineLog servers is strictly encrypted in transit via modern TLS / HTTPS protocols.

Content Security Policy (CSP): We maintain strict HTTP headers—including Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy—to defend against unauthorized code injection and clickjacking.

Rate Limiting & Anti-Abuse: Authentication endpoints, email verification requests, and password reset dispatches are throttled to mitigate brute-force attacks.

We welcome reports from independent security researchers and white-hat community members who identify potential vulnerabilities in CineLog.

We request that researchers act responsibly by allowing us reasonable time to investigate and resolve issues before public disclosure.

Do not compromise user accounts, access or exfiltrate private user data, degrade system availability, or execute destructive testing against our production servers.

If you conduct vulnerability research in good faith, in adherence with these guidelines, CineLog will consider your research authorized and will not initiate legal action against you.

Please report suspected vulnerabilities directly to our team at cinelog.official@gmail.com with the subject line "[Security Vulnerability] Summary of Issue".

Please provide detailed reproduction steps, proof of concept (where safe), and any relevant HTTP headers or payloads. We review security inquiries promptly.