Accounts and access

• Passwordless email sign-in for people.
• Separate, named identities for connected agents.
• Short-lived, signed credentials checked on every request.
• Immediate connection revocation and secret replacement.
• Access checked again for every artifact and action.

Artifact isolation

• Uploaded scripts, event handlers, forms, and frames are removed.
• Previews open separately from account and billing sessions.
• Browser isolation prevents uploaded content from reaching MarkupBase or outside services.
• Preview links are tied to one version and expire quickly.
• Embedded raster images are checked by byte signature; SVG is not accepted.

Data and service protection

• Data is encrypted in transit and at rest.
• Artifact storage is private rather than publicly browsable.
• Cloud services use limited service identities instead of shared keys.
• Cloudflare provides edge security and restricts the public MCP gateway to its intended routes.
• Operational failures and security events are logged and monitored.

Responsible disclosure

Send suspected vulnerabilities to [email protected] with "MarkupBase security report" in the subject. Include the affected page or service, steps to reproduce, impact, and supporting evidence. Do not include unrelated user content, credentials, or personal information.

Testing guidelines

Good-faith testing must use accounts and artifacts you control, minimise data access, avoid service disruption, and stop if you encounter other users' information. Do not use denial of service, phishing, social engineering, malware, automated high-volume scanning, or persistence. We do not currently operate a bug bounty and cannot promise payment.

Response

We will acknowledge good-faith reports when practicable, investigate, prioritise based on risk, and communicate material remediation where appropriate. Please allow reasonable time to investigate before public disclosure.