Security

Last updated November 1, 2026.

The safest data is data we don't have, so most of our security is about not collecting things. For what we do handle, here's how it's protected.

Your data

• Passwords are never sent to us. Your browser hashes them and only sends a 5-character prefix (k-anonymity).
• Email addresses are never stored in the clear. Stored copies are encrypted with AES-256-GCM, and lookups use a keyed hash (HMAC-SHA-256). Each key is derived for one purpose only.
• Report links are 256-bit random codes, stored only as a hash. Each one works once, for 15 minutes, and only in the browser that asked for it.
• The code travels in the part of the link after the #, which browsers never send to servers, so it can't end up in logs or referrer headers.
• Breach details are only shown to whoever controls the inbox, so nobody can use Sorrel Identity to profile somebody else.

The site

• HTTPS only, with HSTS.
• A strict Content Security Policy: only our own scripts, styles and fonts, nothing inline, no framing. Trusted Types are enforced, so pages can't write raw HTML even if something goes wrong.
• No third-party scripts, trackers or analytics.
• Actions only accept requests from our own pages. Rate limits apply per visitor, per address and overall.
• The server runs on Node with one outside package, the widely used SimpleWebAuthn library for passkey verification, rather than hand-written cryptography. That keeps the supply-chain surface small.

Accounts

• No passwords. You sign in with a passkey (WebAuthn, with user verification required) or a one-time email link that only works in the browser that asked for it.
• Passkeys are bound to identity.sorrel.cc, so a look-alike site can't use them. We store only public keys and check every sign-in signature and counter.
• Sessions are random codes in HttpOnly, Secure, SameSite=Strict cookies. Only a hash is stored. They end after 30 days, or 14 days without use, and you can sign out other devices from your dashboard.
• Adding or removing a passkey, signing out other devices and deleting your account need a sign-in from the last 15 minutes.
• Your account history shows every sign-in and security change.

Report a problem

Found a vulnerability? Email support@sorrel.cc with "Security" in the subject. Tell us what you found and how to reproduce it. Please don't access other people's data, run denial-of-service tests or send spam while testing. We'll reply within 3 business days, keep you updated, and credit you if you'd like. We won't take legal action over good-faith research that follows these rules.

Our security.txt has the same details.