Security
A plain overview of how this site protects information and how to report a problem responsibly. It describes the studio’s practices without publishing the kind of detail that would only help someone attack them.
Defence in depth
No single control is trusted to be the whole defence. The browser is sent a set of hardening headers, requests pass an edge check before they reach the application, and every action that changes data is authorised again on the server against the real session — which is the layer that actually decides what you can see and do. The outer layers are there to fail safely; the inner one is the authority.
Your information
There is no third-party JavaScript on the site — no analytics script, no advertising pixel, no session recorder — so nothing you do here is quietly handed to another company. What little is stored, and what is deliberately never stored, is described in full on the privacy page. Sign-in cookies are inaccessible to scripts, and access is granted on a least-privilege basis: an account gets only the permissions its role needs.
Unpublished work stays unpublished
Publication status is authoritative everywhere in the system, not decided page by page. Drafts, internal notes, and restricted material are withheld from every public surface by the same rules — and the AI assistant, where it is available, answers only from published records. It has no path to draft or confidential content, so it cannot reveal what it cannot reach.
Reporting a vulnerability
If you believe you have found a security issue, please tell the studio before disclosing it anywhere else. Get in touch with what you found, the steps to reproduce it, and its likely impact, and you will get a direct reply.
Good-faith research is welcome, and the studio will not pursue action against you for it, so long as you:
- act in good faith and avoid privacy violations, data destruction, or service disruption;
- only ever access your own data — never another person’s — and stop as soon as you have confirmed a vulnerability exists;
- give the studio a reasonable chance to fix the issue before disclosing it publicly.