MindActions takes platform security, data integrity, and privacy safeguards seriously.
Designated Vulnerability & Security Contact
If you are a security researcher, developer, or user who has identified a potential security vulnerability or data exposure on MindActions, please contact us immediately:
Security Email: moe.namini@mindactions.app
Alternate Email: admin@mindactions.app
Security Architecture Highlights
Data Encryption at Rest: Sensitive database columns (Spotify/Google OAuth tokens, journal logs, and AI Coach thread strings) are encrypted at rest in our Neon.tech PostgreSQL database using Fernet symmetric multi-key cryptography.
Password Hashing: User account credentials are protected using industry-standard bcrypt password hashing.
Data Sanitization: Automated PII Scrubber (scrub_pii) middleware filters sensitive personal identifiers prior to external API transmissions.
Data Transport: All network communications enforce mandatory TLS 1.3 / HTTPS encryption.
Vulnerability Disclosure Guidelines
When reporting a vulnerability, please provide steps to reproduce the issue and avoid accessing or modifying non-test user accounts. We review security disclosures within 48 hours.