Security policy

Security approach

WeKinly follows least-privilege access, secure defaults and data minimisation. Authentication credentials are hashed, sessions use protected cookies, and privileged event actions require an authenticated organizer.

Platform safeguards

The application applies browser security headers, validates server-side actions and separates public guest access from organizer controls.

• HTTPS and secure cookies in production
• Content-type, framing, referrer and browser-permission protections
• Environment-based secrets and verified email delivery configuration
• Dependency, access and incident review before production release

Uploads and guest links

Organizers should share event and invitation links only with intended guests. Uploaded media may contain personal information; guests should upload only content they are allowed to share.

Payments and incidents

Card entry takes place in Stripe Checkout. WeKinly keeps transaction references rather than full card data. Suspected incidents are assessed, contained and documented; legally required breach notices are made within applicable deadlines.

Report a vulnerability

Do not publicly disclose a suspected vulnerability or access other people's data. Use the Contact form, choose “Security”, and include reproduction steps, impact and contact details. Do not disrupt the service or use social engineering. Good-faith reports will be investigated and coordinated responsibly.