Security

Security is part of how Ext0 is designed. This page describes our practices; it is not a claim of any formal certification, which we have not obtained.

Application security

• HTTPS everywhere; secure, HTTP-only, same-site session cookies.
• Passwords hashed with Argon2id; optional TOTP two-factor authentication.
• Strict tenant isolation enforced server-side on every query, with automated cross-workspace tests.
• Role-based permissions checked on every API mutation; CSRF protection on session-authenticated routes.
• User-submitted Markdown is sanitized on the server before rendering.
• Rate limiting on authentication, posting and voting.

Widget isolation

• The widget UI runs in a cross-origin iframe; the host page never gains DOM access to it.
• postMessage traffic is validated by origin, source and schema with a per-instance handshake.
• Public workspace keys cannot read private data. Signed SSO tokens are verified server-side and expire within minutes.

Operations

• Database and cache bound to private interfaces; least-privilege access.
• Encrypted, automated backups with periodic restore tests.
• Audit logs for billing, permissions, moderation, tokens and exports.

Reporting a vulnerability

Please report suspected vulnerabilities via our contact form (topic: Security report). Do not access other customers' data, degrade the service or publicly disclose before we have had a chance to respond.