Security

Here is how we protect NullDaily accounts, and how to tell us if you find a problem.

How accounts are protected

• Passwords are hashed with Argon2id. We never store or log them in plain text.
• Sign-in supports passkeys, authenticator apps (TOTP) and single-use recovery codes.
• Session cookies are HttpOnly, Secure and SameSite. Every change is protected against cross-site request forgery.
• Sign-in, reset and code checks are rate limited.
• Changing or resetting your password signs out your other devices.
• Apps get access only through a consent screen. Codes require PKCE, refresh tokens rotate, and reuse revokes the whole chain.
• Security events (sign-ins, new devices, changes to 2FA and connected apps) appear in your account activity.

Report a problem

If you think you have found a security issue in a NullDaily account or product, email [email protected] with "Security report" in the subject. Include what you found and how to reproduce it. Please do not access other people's data or disrupt the service while testing. We will reply, keep you posted, and credit you if you like.