Security starts before the product ships

Current scope

The public website collects an email address for early-access management. It does not currently store social-account credentials, uploaded campaign media, payment details, or production publishing data.

Waitlist provider

Clerk processes waitlist submissions and related confirmation or invitation messages on Sociaxo's behalf. Secret credentials are kept outside the public source code and must be configured through protected deployment environment settings.

Website safeguards

• HTTPS is required for the production website.
• Response headers restrict framing, content-type sniffing, referrer data, camera, microphone, and geolocation access.
• Marketing routes remain public; future authenticated routes will require separate authorization controls.
• Dependencies, production builds, and configuration are reviewed before release.

Report a security concern

Send a clear description, affected URL, reproduction steps, and potential impact to hello@sociaxo.com. Do not access data that is not yours, disrupt the service, or publicly disclose a concern before Sociaxo has had a reasonable opportunity to investigate.