How this site is defended, and how to tell me it is not

Everything is served over HTTPS. The database is managed Postgres with encryption at rest. Nothing you send crosses a public network or sits on a disk in plain text.

Every table has row-level security enabled and forced. Forced is the part usually left off: without it the table's owner bypasses its own policies, so anything running as that role reads everything while the policy still looks correct.

The public key your browser holds can read published content and nothing else. It cannot read an enquiry, cannot write one, and cannot see an unpublished draft. Submissions never reach the database straight from the browser — they pass through a server action that rate-limits, validates and checks them first, with a key that never leaves the server. That ordering is what makes the validation real rather than advisory.

Integration credentials are stored encrypted with AES-256-GCM, authenticated so a tampered record fails to decrypt rather than decrypting to different bytes. The encryption key lives in the deployment environment and never in the database beside what it protects.

No credential is ever displayed back — not masked, not behind a reveal, not the last four characters. A store that will show you a secret will show it to whoever borrows your session. The real question is always whether a credential still works, and the way to answer that is to use it, which the administration area does by sending a genuine test notification.

There is no public sign-up and no way to create an account from inside the administration area. Accounts are created directly against the database from a machine that already holds the deployment credentials. A valid login belonging to someone who is not an administrator is signed straight back out rather than left holding a session.

Sessions are verified against the authentication server on each request rather than trusted from the cookie, and every page and every action re-checks authorisation for itself instead of relying on the one check in the layout above it. Postgres enforces the same rule underneath, so a mistake in one of those checks is not a way past the other.

As it stands today it takes no payments and stores no card details, has no visitor accounts, and loads no third-party scripts. If something claiming to be this site asks you for a password or a card number, it is not this site.

Email Mahdii.Support@gmail.com with enough detail to reproduce it. I will confirm receipt within three business days and tell you what I found, whether or not it turns out to be exploitable.

Two requests while you look: do not test with other people's real data, and do not run automated scans heavy enough to degrade the site for anyone else. Give me a reasonable window to fix what you find before publishing it.

There is no bug bounty — this is one person's site, not a programme — but if a finding is real and you want the credit, you will get it by name.