Security

1. Platform

EndURL runs on Google Cloud via Firebase. Data is encrypted in transit (TLS) and at rest by the platform. Application access follows least privilege: customer reads are constrained by database security rules, and all privileged writes go through server-side code with role checks and audit logging.

2. Account & API security

Authentication is handled by Firebase Authentication (email/password with verification, Google sign-in). Sessions use http-only cookies. API keys are scoped, shown once, stored only as SHA-256 hashes, verified in constant time, and instantly revocable. Sensitive actions are recorded in audit logs.

3. Link and destination safety

Destination URLs are validated against SSRF-safe rules (http/https only, no private hosts or IP literals, no embedded credentials), checked against blocklists, and flagged for suspicious patterns. Password-protected links use bcrypt hashing with attempt rate limiting. Blocked links stop resolving platform-wide within about a minute.

• Reserved-route registry prevents system-path hijacking
• Deleted aliases are permanently tombstoned
• Redirect anomaly throttling limits abuse bursts
• Public abuse reporting at /report-abuse feeds a triage queue

4. Responsible disclosure

Found a vulnerability? Email security@endurl.com with reproduction details. We commit to acknowledging reports within 72 hours, keeping you informed, and not pursuing action against good-faith research that avoids privacy violations and service disruption.