Security and privacy

Plumbline keeps very little about you and treats every link it opens as hostile.

Your data

• Stored: your Telegram user id, plan state, daily usage counters, a check history kept for 30 days and then deleted automatically, and any watchlist items, reports and payment records you create.
• Not stored: your name, username, phone number or messages other than the links and addresses you check.
• /deletemydata erases everything about you at once.

The full detail is in the privacy policy.

Opening links safely

• DNS is resolved and checked before any request. Private, loopback, link-local and cloud-metadata addresses are refused, again on every redirect.
• At most five redirects, a 512 KB page limit, short timeouts, ports 80 and 443 only.
• Pages are read as text. Scripts are never run.

The service

• Every Telegram update is verified with a secret token before it is processed, and each update is handled once.
• Requests are rate limited per user. Input is length-limited and validated.
• Secrets are stored as platform secrets, never in the code. The code is scanned for secrets on every change.
• Dependencies are pinned and audited, and every change is reviewed by automated tests before release. Commits are cryptographically signed.
• Logs are structured and contain no secrets or message content.

Report a vulnerability

Email joshuamhone9@gmail.com. Please do not publish details until there has been a chance to fix the issue. Plumbline is run by one person, so expect an acknowledgement within a week. The machine-readable policy is at /.well-known/security.txt.