Phonq treats security as part of the product. Here's what we do to keep the platform safe, and how to report issues.
What we do
All traffic is served over HTTPS with HSTS. Authentication uses OAuth 2.0 (Google) with short-lived, signed JWT sessions — we never see or store passwords.
Database access uses connection pooling via Neon and least-privilege credentials. Secrets are environment variables, never committed to the repository.
The app is protected by a rate limiter on API routes, secure default headers, and dependency updates reviewed regularly.
Responsible disclosure
Found a vulnerability? We appreciate responsible disclosure. Email security@phonq.app with a clear description and proof of concept — don't exploit it beyond what's needed to demonstrate it.
We'll respond within 7 days, keep you updated on the fix, and give you credit if you'd like it.