Security

How CineSteward keeps your account and data safe, and how to tell us if you find a way it doesn't.

Your account

• Passwords are never kept as they are, only as a salted hash (PBKDF2 with SHA-512, 210,000 rounds), and common or too short passwords aren't accepted.
• Two-step sign-in with an authenticator app, and recovery codes for when you can't use it.
• Every new sign-in is announced on your other devices, also one on this website, and you can sign any device out under Settings → Security.
• Wrong passwords slow things down: after ten from one place, signing in to that account from there pauses for 15 minutes, and after fifty from anywhere, everywhere; here and in the app alike.
• Sign-ins end by themselves after 60 days without use, and after 180 days at most.

The app

• Updates are signed by the CineSteward team, and the app installs only an update whose signature it can check, so nobody else can push one to you.
• Everything it sends goes over HTTPS, and the sign-ins it keeps on your device are in your system's protected storage where it has one.
• An app lock with a PIN keeps CineSteward closed to others using your computer.

The server and this website

• The CineSteward server is in Germany, takes its security updates by itself, and lets in nothing but HTTPS and the team's encrypted access.
• This website runs no scripts, sets no cookies, and loads nothing from anywhere else; a strict content policy makes browsers refuse anything that isn't its own. Browsers only ever reach it over HTTPS.
• What's kept, and for how long, is in the privacy policy.

Report a security problem

Found a way into an account, someone else's data, or the server? Please tell us first, privately, at CineSteward@protonmail.com, with:

• what you found, and what it lets someone do
• how to see it for ourselves, step by step
• which version of the app, or which address on the server

We answer within a week, keep you posted while we fix it, and say thanks by name in the release that fixes it if you like. Please give us time to fix it before you tell anyone else; 90 days at most.

Looking for problems, fairly

Use your own accounts, and stop as soon as you reach anyone else's data: don't look further, keep a copy or change it. Don't slow down or stop the CineSteward server, don't send spam, and don't try to trick people or the team. Act in good faith within these rules, and we won't take legal action against you. CineSteward has no reward programme.

This is also in machine-readable form, at /.well-known/security.txt.