Security Policy
What the architecture rules out, what it does not, and how to tell us when we are wrong.
Last updated 12 August 2026 · contact [email protected]
Correction, August 2026. An earlier version of this policy said TypeCrt was “entirely client-side” and sent nothing to any external server. That was wrong. The typing itself is client-side and no keystrokes are transmitted — but the site does load Google Analytics and does record anonymous result events to a backend. The threat model below is written against what the site actually does. Full detail on the privacy page.
Threat model
Security claims are only meaningful against a stated model. Here is ours, split into what the design genuinely removes and what it does not.
Structurally not possible here
| Class | Why it does not apply |
|---|---|
| Keystroke interception in transit | Typed characters are compared to the target string in the browser and never leave it. There is no request to intercept. |
| Mass password breach | No account is needed and none is created by default. Optional sign-in is delegated to Google Firebase Authentication; TypeCrt never receives or stores a password. |
| SQL injection | There is no SQL layer under the site. Events are written through Firestore's client SDK, which does not concatenate queries. |
| Server-side RCE on the app | The application is static files on Cloudflare Pages. There is no application server executing request-time code to compromise. |
In scope — report these
| Class | Where it could realistically appear |
|---|---|
| Cross-site scripting | Custom-text and custom-quote input, imported theme JSON, or any field rendered back into the page |
| Malicious theme or config import | The theme creator and settings import path, which accept user-supplied structured data |
| Firestore rule weakness | Analytics writes and synced history reads — e.g. any path letting one account read another's rows |
| Local data exposure | Any route by which one origin's localStorage becomes readable by another |
| Dependency compromise | The third-party scripts the site loads, listed on the privacy page |
| Result forgery | Fabricated scores submitted as genuine, where they would appear anywhere public |
Out of scope
- Reports produced solely by an automated scanner, with no demonstrated impact
- Missing hardening headers with no exploit path shown
- Anything requiring the victim's device or browser to already be compromised
- Social engineering, physical access, or attacks on third-party services themselves
- Denial of service, volumetric testing, or anything degrading the site for other people
Verify the central claim yourself
The strongest statement on this page — that your keystrokes are never transmitted — is one you should not take on trust. It takes about thirty seconds to check:
- Open
typecrt.comand press F12, then the Network tab - Type a full test to completion
- Inspect every request that fired. The completion event carries WPM, raw WPM, accuracy, mode, duration and theme — and no text
This is deliberately stated as a procedure rather than an assurance. A claim you can reproduce in your own browser is worth more than one we simply repeat, and if the procedure ever produces a different result than described, that is a bug and we want the report.
Reporting a vulnerability
Do not open a public issue. Email [email protected] and include:
- A description of the issue and its impact
- Exact steps to reproduce it
- Your browser and version, and the operating system
- A proof of concept where one exists, and any suggested fix
TypeCrt is maintained by one person. Reports are acknowledged within 72 hours, triaged with a severity assessment and an intended timeline, and you are told when the fix ships. There is no monetary bounty; credit on this page is offered to anyone who wants it, and withheld from anyone who does not.
Safe harbour. Good-faith research within the scope above — testing against your own browser and your own data, not degrading the service, not accessing anyone else's data, and giving us a reasonable window before disclosure — will not be met with legal action. If you are unsure whether something is in scope, ask first.
Supported versions
TypeCrt is a continuously deployed web application, not versioned software you install. The copy served at
typecrt.com is the only supported one, and it is what gets patched. Loading the page gets you
the current build; there is nothing to update.
Practices
- Transport — HTTPS everywhere, with HSTS handled at the Cloudflare edge
- Authentication — delegated to Firebase Authentication; no password ever reaches TypeCrt
- Least data — account features are opt-in, and the anonymous event payload is limited to the fields enumerated on the privacy page
- Static delivery — the application is prebuilt static assets, so there is no request-time code execution on the origin
- Honest correction — when a published claim turns out to be wrong, it is marked and corrected in place rather than quietly deleted, as above
Acknowledgements
No vulnerabilities have been reported to date. Researchers who report a confirmed issue will be credited here by name or handle, at their choice.