Security

The product works from public information and what you choose to share. There is nowhere in appea.ls to enter a platform password, and our data model has no place to store one.

Passwords for appea.ls itself are hashed with Argon2id, sessions are stored server-side and can be ended from Settings, and repeated failed sign-ins trigger a lockout. You can turn on two-step sign-in with an authenticator app, or add a passkey. Google and Discord sign-in can't skip two-step sign-in: accounts that have it on must use their code or a passkey. Changes to your password, email, two-step sign-in and sign-in methods are emailed to you. Every case, draft and upload is checked against your account on every request.

Ban screenshots are limited to PNG, JPEG and WebP up to 4 MB, safety-checked, read once and deleted. They are never stored.

Found a vulnerability? Email us at the address below. Please don't access other people's data while testing.