Security
How we protect subscriber data
Public-data-only architecture means most of our security surface is small by design: we never see card numbers, never store passwords, and never collect sensitive personal categories. The controls below cover what we do handle: subscriber email, Stripe customer IDs, share tokens, and our own admin tooling.
For the buyer doing diligence
Not technical? Here's the only sentence your IC needs: because we rank publicGitHub data, we never hold your card, your password, or anything sensitive, so the worst case of a breach is an email list, and even that is encrypted and EU-hosted. The detail below is for your security reviewer; you don't need to read it to clear us.
Start with the most-requested trust routes
Most buyers checking security also want current status, disclosure policy, and the processor list behind the system.
Transport security
- HSTS preload (
max-age=63072000; includeSubDomains; preload), included in the Chromium HSTS preload list. - TLS 1.2+ only; cipher suites curated by Vercel's edge.
- Strict CSP (
default-src 'self') with auditable allowlist for PostHog EU and inline scripts. - X-Frame-Options: DENY (no embedding).
- Referrer-Policy:
strict-origin-when-cross-origin. - Permissions-Policy blocks camera, microphone, geolocation site-wide.
Email security
- SPF, DKIM, DMARC
p=quarantineon the gitdealflow.com sending domain. - MTA-STS policy at /.well-known/mta-sts.txt: inbound mail
enforcemode. - TLS-RPT reporting on
_smtp._tls.gitdealflow.com. - Resend handles transactional sends; audience hygiene tracked in
lib/excluded-emails.mjs.
Authentication & secrets
- No user passwords. Free signups: email-only opt-in. Paid users: API keys (
gdf_v2.cus_xxx.<hmac>) bound to a Stripe customer ID. - Share tokens are URL-safe random IDs scoped to a single resource, with no enumeration vector.
- Admin tools: hardware-key MFA on Vercel, Stripe, Resend, GitHub. No shared admin credentials.
- Operator x402 wallet uses Coinbase CDP Server Wallet v2, Wallet Secret stored in Vercel encrypted env.
Vulnerability disclosure
We follow the disclose.io core terms. Safe harbor for good-faith research, 72-hour acknowledgement SLA, attribution on the hall-of-fame page (or anonymous, your choice).
- Full policy: /disclosure
- RFC 9116 contact: /.well-known/security.txt
- Machine-readable: /.well-known/disclosure.json, /.well-known/security-policy.json
Subprocessor controls
We rely on the SOC 2 Type II / ISO 27001 footprints of upstream processors for the foundation: Stripe (PCI-DSS Level 1), Vercel, Resend, PostHog EU, Hetzner. Full inventory and DPAs at /subprocessors.
Incident response
- 72-hour breach notification to subscribers (GDPR Art. 33).
- Public corrections log at /corrections.
- Annual transparency report at /transparency with a standing warrant canary.
- Status surface at /uptime.
Clearing this for a fund? Here’s the path, and the no-card way to start.
Your legal or IC team can clear this page without an engineer in the room, that’s the point. When they’re done, most funds start on the free Sunday digest to pressure-test the signal, then move to the application-gated Sharp tier once it’s earning its seat. No card to read the digest, and nothing on this site auto-charges.