Security practices

• ▸In transit. TLS 1.3 across all subdomains. HSTS preloaded. No HTTP fallbacks.
• ▸At rest. provider-managed encryption (AES-256) for application data, intake records, and the qualification ledger.
• ▸Secrets. API tokens, webhook URLs, and provider credentials live in Vercel encrypted environment variables, never in the repo.

• ▸FORKOFF staff access to intake records and ledger data is gated behind SSO with hardware-key-backed 2FA.
• ▸Brand-side dashboards: invite-only, scoped to the campaigns the account owns. No cross-tenant visibility.
• ▸Clipper-side dashboards: scoped to the clipper's submitted clips and payout history.
• ▸Service-account credentials rotate on a fixed schedule and on any team-membership change.

Every state-changing action on an intake record, qualification entry, or payout settlement writes an append-only log line. Logs include actor, action, timestamp, and a content hash of the affected record. Brands receive a per-campaign export of the relevant log slice with their qualification ledger.

• ▸Vercel. hosting, analytics, edge.
• ▸Resend. transactional email.
• ▸Slack. internal intake routing.
• ▸Google Analytics + Microsoft Clarity. gated behind cookie consent.

Each vendor is bound by data-processing terms. We do not share intake or ledger data with any vendor not listed above.

If you find a security issue, report it to security@forkoff.xyz (or crew@forkoff.xyz as a fallback). We aim to:

• ▸Acknowledge within 2 business days.
• ▸Validate or triage within 7 business days.
• ▸Ship a fix or mitigation within 30 days for confirmed issues.
• ▸Credit reporters in the acknowledgments below if they want public credit.

Please don't run intrusive scans, dump customer data, or chain proof-of-concepts that disrupt service. Coordinated disclosure is welcome.

Our machine-readable security contact follows RFC 9116: /.well-known/security.txt.

Researchers who have reported confirmed issues will be listed here with their consent.