Security
The surprise needs a boundary.
WishCodes is an early accountless product. This page describes the controls currently implemented, without pretending that any system is risk-free or independently certified.
Private by default
Database rows are not directly readable by anonymous clients.
Separate capabilities
Share and owner links are different, high-entropy capabilities.
Short-lived sessions
Exchanges create secure, expiring HttpOnly sessions.
Current controls
What we verify in the application
- Share and owner capabilities are read from URL fragments, removed from the visible URL, exchanged in POST bodies and never accepted in request paths or query strings.
- Only one-way hashes of profile capabilities and session tokens are stored by the application.
- The Supabase-backed tables use row-level security and anonymous/authenticated direct reads are disabled; server routes use the server-only service role.
- Private profile fields are not returned by giver routes, analytics properties, page metadata or public link-preview assets.
- At profile creation, a salted one-way fingerprint derived from limited transient network/browser signals helps discourage the creator from opening their own share link; raw IP and User-Agent values are not stored for that check.
- OpenRouter and Supabase credentials are server-only; client-bundle audits check for accidental secret exposure.
- Input schemas, body-size limits, request timeouts, bounded retries and shared rate limits protect the generation routes.
- The private operator dashboard is gated by a configured private path, server-side password verification and a short-lived secure HttpOnly session; it returns aggregate data only and is not in the sitemap.
Report a concern
Please report suspected security or privacy issues to work@atharv.me. Do not include a share capability, owner capability, private quiz answers or other secrets in the report. WishCodes does not currently operate a public bug-bounty or security certification program.