Skip to main content
Orbzz

Security

Security without the badge wall

Orbzz is not launched, not certified and not audited. Here is exactly what exists, what is planned, and how to reach us if you find something wrong.

Status: pre-release. There is no production service, so there is no bug bounty, no uptime figure and no audit report to publish yet.

Today

Controls in the development repository

These are engineering controls in code that is still unreleased. They are not a claim about a running service.

Password storage

Exists

Argon2id (m=64 MB, t=3, p=1) with a pepper kept outside the database, and a constant-time dummy verification so unknown emails are not disclosed.

Sessions

Exists

Short-lived access tokens with rotating refresh tokens, reuse detection that revokes the whole token family, and HttpOnly cookies scoped to the auth path.

Rate limiting

Exists

Sliding-window limits on registration, sign-in, verification and reset flows, per IP and per account.

Input handling

Exists

DTO validation on every endpoint and parameterised queries only through the database client.

Uploads

Exists

Size limits, content-type and magic-number checks, and re-encoding of images so metadata such as EXIF is stripped before storage.

Secrets

Exists

No credentials in the repository; every environment value is documented and validated at boot.

Roadmap

What is planned, and what we will not claim

End-to-end encryption (Early Preview)

Planned

End-to-end encryption for one-to-one chats is in early preview and not independently audited. Orbs and group chats are not end-to-end encrypted.

Independent testing

Planned

A penetration test and a responsible-disclosure programme are planned before any public launch.

Certifications

Planned

No SOC 2, no ISO 27001 and no GDPR certification today. We will not display badges we cannot back with evidence.

Uptime commitments

Planned

No availability figure is published because there is no production service to measure yet.

Report

Found something wrong?

How to reach us

For confidential vulnerability reports, please use GitHub Private Vulnerability Reporting directly on our repository. For general inquiries, reach out through the contact page.

What we promise

A human reads it, we confirm receipt, and we tell you what we found. We do not promise a response SLA yet, because there is no staffed rotation — that arrives with the disclosure policy.

Related drafts