Transport
HTTPS/TLS wraps marketing surfaces and authenticated app surfaces.
Accounts & integrations
Store credentials exclusively through sanctioned flows—not email slips.
Threat model realism
We cannot guarantee detection cloaked behind novel slang rotations, multilingual code-switch blends, ephemeral accounts deleted prematurity, ingestion gaps, purely offline escalation, or untouched apps.
Responsible disclosure
Send reproducibles privately first where feasible—we triage urgently.
Certifications caveat
Hardened operations precede billboard compliance badges—milestones disclosed when verified.