Security

Security claims should be narrow enough to verify.

This page describes controls visible in the current application code, and says where operational evidence is still required.

Updated 31 August 2026

Draft status. A review draft: not indexed, and not final until checked by qualified counsel.

How is access controlled?

Authentication is delegated to Clerk; Press Hub stores no passwords and issues no session cookies of its own.
Two independent gates: middleware denies by default, and every gated page and API route re-checks authorisation at the resource. A drifted path pattern therefore fails closed rather than open.
Gated responses carry a no-index header and private, no-store caching, which reaches JSON and CSV responses that a meta tag cannot.
Workspace ownership is passed to the AI tools as server-side context, never as a model-chosen argument, so no prompt can talk the assistant into another workspace’s data.

How are the endpoints strangers can reach protected?

Provider webhooks are verified by HMAC signature over the raw body before anything is read from them.
Scheduled jobs authenticate with a bearer secret held outside the codebase.
Unsubscribe, click and open endpoints are reached by recipients who can never hold an account. The token is the credential and resolves to exactly one recipient row.
Model output that becomes a document passes through a whitelist translator that emits only from an allowed node set, so a prompt-injected script tag cannot survive into an email.

How do I report a vulnerability?

Write to hello@pressdb.co with enough detail to reproduce it. The same address is published at /.well-known/security.txt. Please do not access data beyond what is needed to demonstrate the issue, and do not run tests that degrade the service for other people.

There is no bug-bounty programme and no committed response time. Good-faith research within those limits will not be pursued.

What is not yet evidenced?

Independent penetration testing, a formal incident-response runbook with rehearsed timings, a backup-restore test with a measured recovery objective, and a signed vendor register. Those are operational facts, not code, and the repository cannot demonstrate them — so this page does not claim them.