← Back to Tightly

Security Policy

Last updated: 19 May 2026

Reporting a Vulnerability

Do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Please send a responsible-disclosure report by email to:

security@tightly.nl

Include as much detail as possible:

Type of issue (e.g. SQL injection, broken auth, data leak, XSS)
Full path of affected source file(s) or endpoint(s)
Branch/commit or direct URL
Steps to reproduce and proof-of-concept (if safe to share)
Estimated impact and how an attacker could exploit the issue

We aim to acknowledge reports within 72 hours and will keep you updated on the remediation timeline.

Data Storage & Liability Disclaimer

Tightly stores all user data — journal entries, photos, chapters, books, preferences, and feedback — in Supabase, a managed Postgres + Object Storage platform running on AWS infrastructure.

What this means for users

Your data is subject to Supabase's Privacy Policy and Terms of Service, in addition to Tightly's own privacy policy.
Supabase stores data in the EU region by default; the exact region depends on the project configuration at the time you registered.
Tightly uses Supabase's built-in Auth (magic-link / email + password). Passwords are never stored in plaintext; tokens are JWTs signed with Supabase's project secret.

No warranty or liability for stored data

The operator of tightly.nl (Magnus Jerono) provides this service on an "as is" basis. To the maximum extent permitted by applicable law:

No warranty is made regarding data availability, durability, or confidentiality.
The operator accepts no liability for any loss, corruption, theft, or unauthorised access to user data stored in Supabase or any other third-party system used by Tightly.
Users are solely responsible for exporting and maintaining their own backups using the in-app export, PDF, or account-deletion features.

Technical Security Controls

Control	Implementation
Row-level security	Every Supabase table is locked to `auth.uid()`; storage bucket paths are user-scoped
JWT verification	All `/api/*` endpoints verify Supabase JWTs server-side via the service-role key
Transport	HSTS (2 yr, preload), CSP, `X-Frame-Options: DENY`, `nosniff`
AI rate limits	Per-user request caps + global monthly USD spend guard
Dependency scanning	Dependabot, CodeQL, and `npm audit` in CI
Error monitoring	Optional Sentry — no session replay, no PII, scrubbed request bodies
Secret scanning	GitHub Advanced Security secret scanning enabled

Supported Versions

Only the latest production deployment at tightly.nl is actively maintained. There are no separately versioned releases.