Developers
Security model
Off the Clock asks for narrow permissions, keeps no space data in the web app, and signs anything it hands out.
Narrow OAuth scopes
Draft outline
Member, admin, and community scopes, and why each token is there. Link Permissions.
Service auth and delegation
Draft outline
Space credentials, checkUserAccess on every mint, notifyWrite, trusted services.
Signed, expiring URLs
Draft outline
Images and calendar feeds are signed with OTC_IMAGE_URL_SECRET.
Content Security Policy
Draft outline
What otc-web's CSP allows, including frame-src for enabled players.
Secrets and logging
Draft outline
Redacting Debug impls; tokens, keys, cookies, and signatures never logged.
Reporting a vulnerability
Draft outline
Follow the Security Policy: message @ngerakines.me on Bluesky for a private channel. /.well-known/security.txt on the policies site names the same contact.