Security
How this site, and the products it presents, treat security.
Last updated 18 September 2026
1. This site
The site is static: no accounts, no database, no server-side session. The single server function handles the contact form, validates input, rejects automated submissions with a honeypot field, and forwards the message by email. No secrets are shipped to the browser; the email provider key lives only in the hosting environment.
2. The products
All four Wonder products share one security baseline: Supabase PostgreSQL with row-level security on every tenant-scoped table, server-side tenant resolution that never trusts a client-supplied identifier, encrypted-at-rest provider credentials, an immutable audit trail for consequential actions, and deterministic (non-LLM) authorisation. Each product publishes its own security page or help section with specifics.
3. Reporting a vulnerability
If you believe you have found a security issue in this site or any Wonder product, please report it through the contact form and mark it as a security report. We will acknowledge promptly and keep you informed. Please do not test against production tenants that are not yours.