Maktub

Security

Security Policy

If you discover a security vulnerability in Maktub, please report it responsibly. Do not open a public GitHub issue.

Last updated 20 June 2026

Reporting a vulnerability

Contact: security@getmaktub.app
Response SLA: We will acknowledge receipt within 48 hours and aim to provide a resolution or mitigation plan within 14 days.

Please include in your report:

  • A description of the vulnerability and its potential impact
  • Steps to reproduce or a safe, non-destructive proof of concept
  • Affected URLs, parameters, or code paths
  • Any suggested mitigations

We will credit researchers who report valid vulnerabilities (unless you prefer to remain anonymous).

Scope

  • https://getmaktub.app/ — marketing site (in scope)
  • API at a separate origin (e.g. https://api.getmaktub.app/api/v1/*) — in scope; not served by this Next.js app

Out of scope: Cloudflare infrastructure, third-party services (Google reCAPTCHA, Google Analytics), brute-force or denial-of-service attacks against production systems.

Security measures

  • Input validation via Zod on all API endpoints
  • Rate limiting per user/IP on the API backend
  • Google reCAPTCHA v3 on the waitlist form (score threshold ≥ 0.7)
  • Content Security Policy, HSTS, X-Frame-Options, and other security headers on marketing pages
  • HMAC-signed unsubscribe links to prevent arbitrary unsubscription
  • GDPR-compliant data retention with 1-year scheduled deletion on unsubscribe
  • API secrets managed via backend environment — never committed to git