Security

• No passwords. You sign in with Google, GitHub or a single-use link emailed to you, so there is no uxdeck password to steal or reuse.
• Encrypted connections, always. uxdeck.app only works over HTTPS; browsers refuse to load it any other way.
• A sign-in cookie that stays where it belongs. It is only sent to uxdeck's own server, never to other sites or to other parts of uxdeck.app.
• Private by default. A file is seen only by you, until you share it, and only with the access you give.

If you believe you have found a security problem in uxdeck, write to security@uxdeck.app with what you found, the steps to reproduce it and what an attacker could do with it. I will confirm I received it, keep you posted on the fix, and credit you when it is fixed if you would like.

Please give me a reasonable time to fix it before telling anyone else.

When you look for problems:

• Use only accounts and files that are your own.
• Do not access, change or keep other people's data; if you come across some, stop and tell me.
• Do not slow down or interrupt the service, send spam, or trick the people who use uxdeck.

I will not pursue anyone who reports a problem to me in good faith and within these rules.

If a uxdeck file or an exported site is being used to deceive people, for example a page imitating another company's sign-in, write to security@uxdeck.app with the link. The Terms of Service forbid it, and I remove what breaks them.

The security contact is also published in the standard place for security researchers, /.well-known/security.txt.