Security
Security is an operating discipline, not a marketing guarantee.
The platform is designed around server-side authorization, organization isolation, input validation, protected secrets, verified payment webhooks, private files, and auditable administrative actions.
Core design principles
Controls must be verified for the deployed environment and revisited as the product changes.
- Least-privilege access
- Server-side authorization for every protected action
- Organization-scoped data access
- Sensitive values kept out of client bundles and logs
- Validated uploads and private object storage
- Signed, idempotent webhook processing
- Documented backup, retention, and incident procedures
Responsible reporting
Report concerns safely.
A public vulnerability-reporting address will be shown only after a monitored security contact is configured. Do not send secrets, customer data, or exploit payloads through public forms.
Authorized testing is limited to local or explicitly designated Night National Corp. staging environments. Do not test third-party systems or production infrastructure without written permission.