Security

How we look after your data.

We hold very little, and we lock up what we hold. If you find a problem, tell us.

What we hold

Less is safer.

  1. 01Very little. Email addresses (and an optional first name) for people who confirmed a subscription, and messages sent through the contact form.
  2. 02No accounts, no passwords. There is nothing to log in to.
  3. 03No card or UPI details. Payments are switched off. When they are on, a hosted payment page handles them; they never reach our servers.

Nothing on this website collects data from any device. If a product launches, its data practices will be described on this site.

Full privacy policy

Protection

How it is protected.

  1. 01Locked database. Every table has row-level security with no public access. Only our server, holding a secret key that never reaches the browser, can read or write.
  2. 02Hashed tokens. Confirmation and receipt links are stored only as SHA-256 hashes. Unsubscribe links are signed, not stored.
  3. 03No raw IP addresses. To stop abuse we keep a salted hash of the address briefly for rate limiting.
  4. 04Encrypted in transit. HTTPS everywhere, with strict security headers and a content security policy.
  5. 05Bot checks. Forms use Cloudflare Turnstile and a hidden trap field.

Responsible disclosure

Report a problem.

  1. 01Email us. Write to hello@superlabco.com with “Security” in the subject.
  2. 02Include the steps. What you found, how to reproduce it, and what an attacker could do with it.
  3. 03Be careful with data. Do not access, change or keep anyone else’s data. Use your own email address when testing forms.
  4. 04Do not degrade the site. No denial-of-service, spam or automated scanning that floods forms.
  5. 05Give us time. Let us fix it before you publish. We read every report and will reply; we are students, so allow a few days.

There is no bug bounty. Machine-readable contact details are in security.txt.