Security

What the deployment looks like and what happens to your data, stated plainly so you can judge it. Report security issues to team@mobiustime.com.

Deployment isolation

The service runs as a single-purpose container on our own host, behind a reverse proxy that terminates TLS. The container sees only its own data volume and the proxy network; it shares no database server and no filesystem with other services. Mail infrastructure is separate from the application host.

Data isolation

Each application keeps its own SQLite database; there is no shared database server to cross into. Uploaded files live under the application’s own volume, named by the server, never by user input.

Credentials and sessions

Passwords are stored as bcrypt hashes. Verification and sign-in tokens are stored as SHA-256 hashes and expire: 48 hours for verification, 15 minutes for a sign-in link, both single use. Sessions expire after 30 days. Every form carries a CSRF token.

Auditability

Every article save keeps a full revision. Email address and password changes are written to an append-only audit log (which never holds password material), and a hijacked account can be restored to its previous address by the operator.

Backup and restore

A daily job takes a consistent snapshot of the database and the uploaded files, archives it on the host and prunes the archives after 14 days. An offsite machine pulls the archives. Restoring is re-provisioning the container and unpacking a snapshot.

Scope

This is a small service run on an ongoing best-effort basis. There is no bug bounty; there is a mailbox that is read: team@mobiustime.com.

Last updated: 2026-10-06.