Security

Credentials

LINE channel secrets and access tokens are submitted once over HTTPS, stored encrypted, and never returned to the front end — the connection status view shows masked values only. No secret of any kind is present in the pages this site serves; you can verify that by viewing source.

Account passwords are hashed with scrypt. Sign-in supports a six-digit second factor.

In transit and at rest

All traffic is HTTPS. Pages are served with a Content-Security-Policy that blocks inline event handlers and third-party script, a strict referrer policy, and nosniff. Framing is restricted to an explicit allow-list.

Payments

Card details go directly to Stripe and never reach our servers. We store a customer reference, not a card number.

Webhook integrity

Every inbound LINE webhook is verified against its HMAC-SHA256 signature before it is processed. An unsigned or mis-signed request is rejected, not queued.

Reporting a vulnerability

Email the security contact address with enough detail to reproduce it. We will acknowledge within 3 business days. Please give us a reasonable window to fix an issue before disclosing it, and do not access another customer’s data while testing.