Security

Reporting a vulnerability

Security contact (placeholder): security@crewcast.example — this address is a placeholder until the CrewCast domain is finalized; in the meantime please use the feedback page and mark your report "SECURITY".

Please include: what you found, steps to reproduce, and impact. We'll acknowledge within 5 business days.

Responsible disclosure & safe harbor

We support good-faith security research. If you make a good-faith effort to avoid privacy violations, data destruction, and service disruption, and give us reasonable time to remediate before public disclosure, we will not pursue legal action over your research. Do not access other users' data — use test subscriptions.

Abuse reporting

To report abuse of the service (spam notifications, impersonation, misuse of the platform), use the same contact with the subject "ABUSE".

How CrewCast is built (security posture)

• Static frontend served over HTTPS with security headers (HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).
• No accounts, no passwords, no payment data.
• Push-alert backend: serverless functions; database access uses server-side credentials only; row-level security denies all public access; alert-processing endpoints require a server secret.
• No API keys ship in the frontend — all weather sources are public, keyless APIs.