Security

Foundryard doesn’t ask you for a password, and it doesn’t ask you to hand over anything sensitive to build a profile. Here’s how your account is protected.

Sign-in without passwords

• Authentication is OAuth-only, via Google and GitHub. We never see or store a password.
• You can revoke Foundryard’s access at any time from your Google or GitHub account settings, independent of us.

Access control at the database layer

• Every table is behind Postgres row-level security — who can see what is enforced by the database itself, not just the UI.
• Your profile content is public by design (it’s your page); private account data is scoped to your identity alone.
• All traffic is encrypted in transit (TLS).

Payments

Premium billing runs through Stripe Checkout — card details go straight to Stripe and are never seen or stored by Foundryard.

Reporting a vulnerability

Found something? Please tell us before telling anyone else: contact@foundryard.dev. We commit to acknowledging reports within 48 hours, and we won’t pursue good-faith research conducted without harming users or data.