Skip to main content

Security posture

Security should be visible before trust is requested

We keep the public security posture legible so visitors can understand how forms, browser tools, privacy, and abuse prevention are handled.

Public controls

Trust controls built into the template

These controls are intentionally visible because users may submit a support message, use browser tools, or rely on spreadsheet guidance.

Host protection

Canonical host checks and mirror lockdown help keep copied pages from silently taking over the public site.

Browser tools

Client-side tools are designed to process pasted data in the browser and do not upload spreadsheet contents.

Form safety

The contact endpoint uses JSON-only payloads, CSRF checks, body-size limits, honeypots, and optional Turnstile verification.

Privacy baseline

Optional tracking starts denied, consent state is explicit, and personal data is not intentionally logged in plaintext.

Responsible disclosure

Report security issues responsibly

Send a concise description, affected URL, reproduction steps, impact, and any safe proof of concept. Please give the team a reasonable window to investigate before public disclosure.

Security contact

security@sheetfor.com

If you believe you found a security issue, please share enough detail for us to reproduce it and avoid including sensitive personal data in the initial report.

Email security contact

Machine-readable policy

/.well-known/security.txt is published for automated discovery.

View security.txt