Security

This website

This marketing site has no accounts, no passwords, and no stored data. It has exactly one write path: a single server route shared by the Contact form and the Purchase-request form. That route validates every field, caps the request size, runs a Cloudflare Turnstile human check, rate-limits by IP address, and confirms the sender's email domain can receive mail. Only then does it send an email. Nothing submitted through either form is stored here.

The OwnDocs product

Once you deploy OwnDocs, private (password-protected) mode uses signed sessions with an expiry and a fixed signing-algorithm allowlist, revokes a session on logout, and sends a header telling search-engine crawlers not to index the site. The built-in MCP server checks its access token with a constant-time comparison and validates every requested page path to block traversal outside the docs. The OpenAPI embed fetches remote specs through a fetcher built to resist server-side request forgery, with a size cap.

Reporting

Security disclosures: security@odx.bd