The specifics, including what isn't done yet. Security claims you can't check aren't worth much, so we've tried to make these checkable.
Accounts and sign-in
Passwords are stored only as scrypt hashes.
Sign-in sessions use random 256-bit tokens; we store only a hash of each token, so a database copy can't be used to sign in.
Session cookies are HttpOnly, so page scripts can't read them, and SameSite to resist cross-site requests. Every change also requires a request header other sites can't send.
Sign-in, registration and recovery are rate-limited. Recovery and registration messages don't reveal whether an email address has an account.
Strict separation between accounts
Every record — scenes, entries, comments, tasks — belongs to a workspace, and every query is limited to the workspace of the person asking.
An id from another account behaves exactly like one that doesn't exist: the answer is “not found”.
Automated tests try to read and change other accounts' books across the whole API on every change, and must fail.
A co-author reaches only the books they were invited to, and only the actions co-authors are allowed; every other request answers “not found”. A test walks every route of the API as a co-author on each change.
Reading links
Link tokens are long and random, and stored only as hashes.
Readers see a frozen copy of the chapters you chose, never your live manuscript, and can't change it.
You can revoke a link instantly, or give it an expiry date.
AI processing
Off for each book until you allow it; private scenes are excluded at every layer.
One-off requests with only the excerpts needed — no provider-hosted files, threads or memory.
Quotes in results are verified against your saved text on our servers before you see them.
Transport, storage and backups
HTTPS everywhere, with HSTS, and a strict Content Security Policy that only allows our own scripts.
Database backups are encrypted (age) before they leave the server; the decryption key isn't stored on it. Copies are kept 7 daily, 4 weekly, 3 monthly.
No manuscript text in logs or emails, and search terms are stripped from web-server logs.
Honest status
What isn't done yet
An external security review. Planned before public launch. Until then, everything above is our own work and our own tests.
A full restore drill on a clean machine. Scheduled before we invite writers beyond the pilot; we'll note it here when it's done.
Signed desktop apps. Code-signing certificates are being issued; until then your system may warn you when installing.
End-to-end encryption. Not offered: the studio needs to read your text on our servers to save, search and check it. See privacy.
Found a problem?
Reporting a vulnerability
Please email [email protected] with what you found, how to reproduce it, and what an attacker could do with it.
Use a test account of your own. Don't access, change or keep other people's data, and stop as soon as you've shown the problem.
Don't run denial-of-service or social-engineering tests.
Give us a reasonable time to fix it before you publish. We'll keep you updated and credit you if you'd like.
We don't run a paid bug bounty yet. We won't pursue anyone who reports in good faith within these guidelines.
❦
Bring the draft you have
Import your draft from Word, Scrivener, RTF, EPUB or Markdown, or start on a blank page. The 14-day trial needs no card, and your book is exportable from the first word.
Lore & Lilac