Security

Security practices we commit to publicly. If you find a vulnerability, please tell us first: support@makeranks.com. Good-faith reports are welcomed, acknowledged, and never met with legal threats.

Account protection

• Failed logins return one generic message — the response never reveals whether an email is registered.
• Passwords are stored only as one-way bcrypt hashes by our authentication provider (never in plain text, never visible to us).
• Passwords must be at least 10 characters and include uppercase and lowercase letters, a digit and a symbol.
• Rate limiting and temporary lockout apply per IP address and per account, on sign-up, login and password-reset requests.
• Password-reset links are single-use and expire.
• Sessions live in httpOnly, secure, SameSite cookies and can be revoked by logout.

Application security

• Every input is validated and sanitized on the server, never only in the browser.
• Entitlements (plan, export counts, trial watermark) are decided on the server and every export is authorized there first; the client cannot grant itself permissions.
• The database enforces row-level security: an account can read only its own record and cannot change its own plan or usage.
• Strict security headers (HTTPS-only, frame, content-type and referrer protections) on all pages.
• Payment webhooks are verified against Polar’s cryptographic signatures, and plan changes are always re-read from Polar rather than trusted from the message.
• We never see full card numbers — payment collection is handled by Polar as merchant of record.

Infrastructure

• All traffic is TLS-encrypted; certificates are managed and renewed automatically.
• Databases are access-controlled and encrypted at rest by our provider.
• Secrets live in the deployment platform’s environment store, never in code.