Security

Last updated 10 October 2026

This page lists the security controls actually in place, and the gaps we know about. UUON holds no SOC 2 report and no ISO/IEC 27001 certification, and none is planned until customers need it. We don't display certification badges.

Report a vulnerability

Email security@uuon.world; it goes straight to the operator. Please include steps to reproduce, and give us reasonable time to fix the issue before disclosure. Test only against your own accounts, and don't access other users' data or degrade the service. Machine-readable contact: security.txt.

Controls in place

Area	Control
Transport	HTTPS only, HSTS with preload (one year, including subdomains), served by Cloudflare
Browser	Strict Content-Security-Policy on site pages (scripts from uuon.world only, no inline scripts; the engine demos under /demo/ use a separate, looser policy), X-Frame-Options DENY, nosniff, Referrer-Policy, Permissions-Policy, cross-origin isolation headers; no cookies
Wallet sign-in	Sign-In with Ethereum (EIP-4361): server-issued single-use nonce, consumed atomically; exact domain and URI; allowed chains; expiry required; 10 nonces per minute per IP. The earlier unverified wallet login was removed on 9 October 2026.
Sessions	Wallet session tokens are random 32-byte values; only their SHA-256 hash is stored; 24-hour expiry
Payments	Stripe-hosted checkout (card data never reaches UUON); webhook signature check with constant-time compare and 5-minute timestamp tolerance; each event credited at most once; amounts re-derived from Stripe's line items, not from metadata; test and live modes can't mix
Billing	Requests are validated before any charge; malformed requests are never billed
CENS ledger	Append-only ledger with a database trigger that prevents overdrawing any account; per-account locking; launch grant limited by database constraints
Secrets	API secrets live in Cloudflare Workers secrets, not in code or repositories
Backups	Neon point-in-time restore, currently limited to the last 6 hours (free plan). No longer-term backups yet.
Monitoring	Cloudflare Workers logs for the site and APIs; live status checks on the homepage

Known gaps (being worked on)

API keys and legacy session tokens are stored in plain text in the database; hashing is planned.
GitHub sign-in does not yet use OAuth state/PKCE; free API keys are issued without email verification.
The older billing webhook does not check event timestamps; it is not used for CENS.
Least-privilege database roles are used for read-only agents; the API itself still uses an owner-level connection.
No external penetration test yet; no long-term backup or restore test yet.

Incidents

If a security incident affects your personal data, we'll inform you and the competent authority as required by Art. 33–34 GDPR. [INCIDENT RESPONSE CONTACT AND PROCESS — confirm]