Security

To report a security problem, write to security@etalonterminal.com.

A report is read and answered by one of the two people who build Etalon. There is no bug bounty, and no disclosure deadline is set on either side. The same contact is at /.well-known/security.txt.

Browsers are told to reach the site over HTTPS only, sign-in cookies travel over HTTPS only, and its security policy lets no outside script run except Cloudflare’s visit counter. Passwords are kept only as salted, slow hashes. Card details are entered on Stripe’s page and never reach this site. Tokens for AI apps connected to the Lab are kept only as hashes.

What is collected and how long it is kept is on the privacy page.