Security Policy

Contact: security@getmaktub.app
Response SLA: We will acknowledge receipt within 48 hours and aim to provide a resolution or mitigation plan within 14 days.

Please include in your report:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a safe, non-destructive proof of concept
• Affected URLs, parameters, or code paths
• Any suggested mitigations

We will credit researchers who report valid vulnerabilities (unless you prefer to remain anonymous).

• https://getmaktub.app/ — marketing site (in scope)
• API at a separate origin (e.g. https://api.getmaktub.app/api/v1/*) — in scope; not served by this Next.js app

Out of scope: Cloudflare infrastructure, third-party services (Google reCAPTCHA, Google Analytics), brute-force or denial-of-service attacks against production systems.

• Input validation via Zod on all API endpoints
• Rate limiting per user/IP on the API backend
• Google reCAPTCHA v3 on the waitlist form (score threshold ≥ 0.7)
• Content Security Policy, HSTS, X-Frame-Options, and other security headers on marketing pages
• HMAC-signed unsubscribe links to prevent arbitrary unsubscription
• GDPR-compliant data retention with 1-year scheduled deletion on unsubscribe
• API secrets managed via backend environment — never committed to git