Security.

01 · The surface

What is exposed, and what is not

The public API surface is read-only views behind a publishable key — the key printed in every receipt is meant to be public, and finding it is not a finding. Row-level security stands on every table; the record's write paths answer only to service credentials, and the operational schemas answer to no public request at all. The one public write door is the interest form: validated, capped, and firewalled from the record it can never touch.

The record itself is designed to make tampering visible rather than merely forbidden: rows cannot be hard-deleted, every change is captured in a revision ledger, and every row's content hash can be replayed against its source.

02 · Reporting

Reporting a weakness

Found something — a way to write where writing is sealed, to read what is not published, to make a figure lie? info@heimlandr.com. Describe what you found and how to reproduce it; you will get a human answer, not a form letter. Please do not run volume attacks against the public door to prove a point about volume — the point is conceded — and do not touch data belonging to anyone who filed the interest form.

There is no bounty program at pre-launch. Reports are credited, with thanks, unless you prefer otherwise.

03 · Disclosure

How disclosure runs

We fix first, then publish. A confirmed weakness and its repair are disclosed on this page by dated revision, in the same register as everything else in the house — a security failure is a correction, and corrections here are public. Give us reasonable time to fix before you publish independently, and we will not make you regret the courtesy.