Security boundary
The browser is an untrusted client. Route guards, validation messages, hidden controls, consent checkboxes, CSRF headers, safe redirects, and sandboxed previews improve the user experience but can be modified by a visitor. Authentication, sessions, authorisation, ownership checks, input validation, sanitisation, rate limits, sending caps, audit logs, and token verification must be enforced by the backend.
The deployment layer is responsible for HTTPS, security headers, content security policy, WAF and bot controls, secrets, dependency scanning, monitoring, backups, and incident response. Review the hosting and provider configuration before relying on any control listed in deployment documentation.
Frontend protections
This application sends API requests with credentials only to the configured API origin, attaches CSRF tokens to state-changing requests, avoids storing session tokens in browser storage, uses same-origin safe redirects, marks token pages as no-referrer and no-store, and renders campaign previews in sandboxed iframes without script or form permissions.
Never paste secrets into the browser console or campaign editor. A public runtime configuration file is intentionally readable and must contain public values only.
Report a vulnerability
Email [email protected] with the affected URL or component, steps to reproduce, impact, and a minimal proof of concept. Allow reasonable time for investigation and remediation, and do not access, modify, or disclose other users’ data. We will acknowledge reports and coordinate a fix where appropriate.
Questions or security reports: [email protected]