Security

Last updated: 2026-10-14

MockaJunkie is built with security in mind.

What we do

• Passwords are hashed with a modern algorithm (Argon2id where available) and never stored in plain text.
• Sessions use strict, HTTP-only, same-site cookies, are regenerated on login, and expire after inactivity.
• Forms carry anti-forgery tokens, and cross-origin form submissions are rejected.
• Browser protections: a strict Content Security Policy, frame blocking, no content-type sniffing, a restrictive referrer policy and HSTS over HTTPS.
• Abuse protection: rate limits on logins, sign-ups and public forms, and honeypot fields.
• Uploads are validated and re-encoded, so embedded code and metadata are removed.
• Payments are handled by the payment processor; we never see or store card numbers.
• Alerts links use long random secrets that are stored only as hashes.

Report a vulnerability

Email superdeeid+mochajunkie@gmail.com with the details and steps to reproduce. Please give us a reasonable time to fix the issue before sharing it publicly, and do not access other people's data.