Report a vulnerability or incident
If you discover a security vulnerability or an ongoing incident affecting Fablesh, report it immediately via the contact form marked "SECURITY". We acknowledge reports within 24 hours and follow the incident-notification duties of the NIS2 directive: early warning within 24 hours, incident notification within 72 hours, and a final report within one month of significant incidents.
Responsible disclosure is appreciated: give us reasonable time to fix an issue before public disclosure, do not access other users' data, and do not disrupt the service.
Technical measures
- All traffic is encrypted in transit (TLS, HSTS with preload).
- Hardened HTTP headers: Content-Security-Policy, X-Frame-Options, nosniff, referrer and permissions policies.
- Authentication via Supabase (magic link / OAuth); no passwords are stored by Fablesh itself.
- Role-based access control: administrative functions require a verified admin role, checked server-side on every request.
- Write operations against the media API require authentication and pass through allowlisted proxies.
- An audit trail records every write operation (who, what, when, outcome).
- Media storage (Cloudflare R2) is isolated from application servers; deletions in the app never destroy stored media files.
- Databases enforce row-level security; service credentials are confined to server environments.
Organisational measures
- Least-privilege access to production systems and secrets.
- Dependency and infrastructure updates are applied continuously.
- Backups of catalog data and configuration, with documented restore paths.
- Incident response: assess, contain, notify affected users and authorities where required (GDPR art. 33/34, NIS2 art. 23).
Your data
How personal data is handled is described in the privacy policy. You can export or delete your account yourself on the account page.