Security.

A full security overview is being prepared. Today: all traffic is TLS; authentication is handled by Supabase Auth with server-verified sessions; private rooms are enforced both in the application layer and with row-level security in the database; passworded share links are bcrypt-hashed and never stored in plain text.

To report a vulnerability: hello@hop.gallery.