Security disclosure
Where to report
Report a vulnerability to zenvorafounder@gmail.com. There is no bug-bounty programme and no paid hall of fame. The server does not send or receive that mail.
What to include
Describe the issue in general terms, the effect you observed, and how to reply to you. Do not include exploit steps, payloads, proof-of-concept code, or other people’s data. This page will not list those steps either.
Give the operator time to read the mailbox before you describe the issue in public. No response time is promised.
What this build actually does
Passwords are stored with scrypt and a salt. Session tokens and reset codes are stored as SHA-256 hashes. Account deletion checks the password before it removes the row. One account cannot read another account’s history through the API. The application log records method, path, and status, not the body.
The phone app keeps the session in the device secure store and sends it as a bearer token. The website does not keep the raw token in local storage. The API sets an HttpOnly cookie. On an HTTPS API that cookie is Secure and SameSite=None. On plain HTTP used while developing, a Secure cookie will not stick, so the cookie is HttpOnly without the Secure flag and is only sent to the same site as the API. An Android development build may keep a copy in private app preferences for the overlay and the keyboard. That copy is not in the Android Keystore. It is removed on sign-out.
The public website is served by Vercel over HTTPS. Accounts and saved translations use the ZENVORA API on this same HTTPS website.
What is not claimed
There is no SOC 2 report, no ISO certificate, and no other security certification. This page does not claim that the service is secure, audited, or compliant. A lawyer and a security reviewer still need to look at it before launch.