Security & disclosure

• TLS 1.2+ in transit, encryption at rest, EU-region database hosting.
• Row-level security on every user table — queries scoped to your user ID at the database level.
• Leaked-password (HIBP) check enforced at signup and password reset; 10-character minimum.
• HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy headers on every response.
• Service-role / admin database key kept server-side only; never shipped to the browser.
• Authenticated server functions verify the bearer token on every call.
• No third-party advertising or analytics SDKs anywhere in the app.
• Roles stored in a dedicated table with a security-definer check function — no client-side privilege escalation surface.

• No third-party penetration test has been commissioned.
• No SOC 2 / ISO 27001 audit. We are a small consumer beta, not yet enterprise-certified.
• Multi-factor authentication is on the roadmap, not in the product yet.
• No formal bug bounty programme — but we will acknowledge good-faith reports (see below).

If you believe you've found a security vulnerability in MenstrualBae, please tell us before telling anyone else. Email security@menstrualbae.app (or hello@menstrualbae.app) with:

• A clear description of the issue and the affected URL or endpoint.
• Steps to reproduce.
• The potential impact as you see it.
• Your name or handle if you'd like credit.

Our commitments to you:

• We will acknowledge your report within 72 hours.
• We will not pursue legal action against good-faith researchers who follow this policy.
• We will keep you updated on the fix and credit you (if you want) once the issue is resolved.

Please do not:

• Access, modify, or download data belonging to other users.
• Run automated scanners that generate significant traffic.
• Publicly disclose the issue before we've had a reasonable chance to fix it (we aim for 90 days).

If we discover a personal data breach that is likely to result in risk to users, we will:

• Notify the UK Information Commissioner's Office within 72 hours, per UK GDPR Article 33.
• Notify affected users without undue delay where the breach is likely to result in high risk to their rights and freedoms (Article 34).
• Publish a post-incident summary on this page once the situation is resolved.

Security issues: security@menstrualbae.app
General privacy: hello@menstrualbae.app