Skip to content
TapToCast
← Home
Legal · Security

Security

Last updated 2026-06-01

TapToCast combines static delivery with authenticated Cloudflare Pages Functions, D1 data, R2 media, role-based access, moderation queues, and audit trails. Our posture focuses on protecting casting data, media, accounts, and confidential sides.

1. Posture summary

  • HTTPS-only, HSTS preload-ready.
  • Strict Content-Security-Policy with no inline scripts, no unsafe-eval, and explicit allow-lists for fonts and images.
  • Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Resource-Policy: same-site.
  • X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin.
  • Permissions-Policy denies camera, microphone, geolocation, browsing-topics, payment, and sensor APIs we do not use.
  • Confidential routes (/sides/*) carry noindex, nofollow, noarchive, nosnippet, noai, noimageai, noml and Cache-Control: no-store.
  • Password accounts use PBKDF2-SHA256 with high iteration counts, per-password salt, and HttpOnly same-site session cookies.
  • Password reset tokens and email verification tokens are one-time, hashed at rest, and expire.
  • Authenticated APIs use cross-origin checks, rate limits, role checks, ownership checks, verified-email gates on sensitive actions, and audit logging.
  • Media uploads are type-limited, quota-limited, stored in R2, and routed through moderation and derivative processing records.
  • Cloudflare provides DDoS protection, WAF, bot management, Pages hosting, D1, KV, and R2 infrastructure.

2. Account and data controls

  • Users can sign in with password or verified Google OAuth accounts.
  • Email verification is required before posting roles, submitting, or uploading media.
  • Password reset invalidates existing sessions after a successful reset.
  • Role-based and ownership-based server checks protect profiles, breakdowns, submissions, boards, organizations, and media owners.
  • Reports, role posts, media, organization verification, and child-safety records flow into admin moderation queues.

3. Coordinated disclosure

Found a vulnerability? Please report it privately to [email protected]. Encrypt with our PGP key on request.

  • We will acknowledge within 3 business days.
  • We will keep you informed as we investigate.
  • We will not pursue legal action against good-faith research that respects the rules below.

Safe-harbour scope

  • Test only against the production domain you found this page on.
  • Do not access, modify, or exfiltrate data belonging to others.
  • Do not perform denial-of-service or stress testing.
  • Do not pivot to Cloudflare or other third-party infrastructure.
  • Do not disclose publicly until we have had a reasonable opportunity to fix.

4. Out of scope

  • Reports generated solely by automated scanners with no demonstrated impact.
  • Missing headers on cached static assets that have no security relevance.
  • Issues in third-party services (please report to those vendors directly).
  • Self-XSS or social engineering of TapToCast staff.

5. Bug bounty

We do not currently offer monetary bounties (the Service is a preview with no revenue), but we will publicly credit researchers who report valid issues, with permission.

6. security.txt

See /.well-known/security.txt for a machine-readable version of the disclosure channel, per RFC 9116.

In plain English. TapToCast is a casting marketplace that helps talent, reps, casting teams, production teams, and producers connect around roles and submissions. We are not a talent agency, manager, employer, or union; we do not negotiate contracts, set rates, or guarantee work. Hiring decisions belong to the production. We host the listings and tools — you bring the craft. Questions about these policies go to [email protected]; suspected scams, impersonation, or abuse go to [email protected].