Security

Report a vulnerability

Write to [email protected] in English or Turkish. Say what you found, how to reproduce it and what it lets someone do. You get an acknowledgement and a status, and credit if you want it; anything that affected people is published as an advisory. Test against your own account and your own sites, never against another person’s account.

The same contact is published at /.well-known/security.txt.

What we hold

• Your account: passkeys (their public keys), verified email addresses, a linked GitHub account.
• Which sites and agents you allowed, and when they last used it, so you can see and revoke them.
• Bindings between your account and agent keys you chose to link, and the attestations issued for them.
• An audit log of your account’s events: sign-ins, a new passkey, a new key, a new connection, a refresh token reused.

What we never hold, and never do

• We never hold, generate, back up or escrow an agent key or seed.
• Nothing of ours signs bytes the caller chooses. Every signature is over a domain-prefixed message we construct, and remembering a site never skips the prompt that shows what is being signed.
• We never push code that runs with a person’s key: no remote update, plugin or hot-swap reaches anything that signs. Every release of something that touches a key ships with a signed tag, a reproducible build, and its hash published somewhere other than the server that serves it.
• No model call on any hApp Auth endpoint. Sign-in is deterministic.
• No fallbacks. If GitHub or mail is down, that path fails plainly and alerts us; it never quietly weakens a proof.
• We never share or sell sign-in history or use it for behavioural profiling. Third-party sites get pairwise identifiers. Optional Proofs sharing is in development: it will disclose only the statement you choose to the recipient and purpose you approve.

The numbers

• No passwords and no magic links. The ways in are a passkey, GitHub and an email code.
• A GitHub sign-in never attaches to an existing account by matching email; linking needs you signed in on both sides.
• Authorization codes work once; access tokens live 5 minutes; refresh tokens rotate, and reusing one revokes the family.
• Every third-party site gets a pairwise identifier for you.

Coming Account actions on happauth.com needing a passkey within the last 15 minutes; a seven-day hold on account actions after an email recovery; signing keys rotated quarterly by schedule; attestation roots held offline, in hardware; an external review of the authorization server and the binding and attestation protocols before the first third-party client.