Security & responsible disclosure

DeedScout uses Supabase Auth, Stripe for billing, and Netlify Functions for server-side Pro checks. User-owned data (watchlists, alerts, profiles) is protected by Row Level Security in Supabase.

Security contact

Email: security@deedscout.app (monitored) · or use Contact with subject “Security”.

Transport & headers

• HSTS, CSP, X-Frame-Options DENY, Referrer-Policy, Permissions-Policy on all pages
• Stripe Checkout — card data never touches DeedScout servers

Rate limiting & abuse

• Checkout and Pro API endpoints: per-IP rate limits on Netlify Functions
• CSV export: client-side throttling on Permit Search and Tax Deeds Pro exports
• Public forms: Netlify honeypot fields

Audit logging

• Stripe webhooks verified with constructEvent — reject unsigned payloads
• Credit spend/refund logged in Supabase credit_ledger with reason codes
• Webhook replay: Stripe event IDs should be deduplicated in production (document idempotency before GA)

Responsible disclosure

Include steps to reproduce and impact. Do not publicly disclose before we acknowledge. We aim to respond within 5 business days.

Trust Center · Privacy Policy