security
Built to be trusted, not just told to be
This community is run by people who break things for a living, so the platform is held to that standard. No system is unbreakable — but here is what we do, plainly.
Strict Content-Security-Policy
No third-party scripts; frame-ancestors none; object-src none.
Hardened headers
HSTS preload, X-Content-Type-Options, COOP/CORP, restrictive Permissions-Policy.
Server-side authorization
Flag checks and privileged actions never trust the client.
Constant-time comparisons
Flag verification resists timing oracles; rate-limited against brute force.
bcrypt-hashed passwords
Credentials are hashed with bcrypt (cost 12) — plaintext is never stored or logged.
Open source
The platform and its tools are auditable. Trust is earned by reading the code.
// responsible disclosure
Found something? Tell us first.
If you find a vulnerability in Vault Ocean or any tool in the arsenal, report it privately before disclosing publicly. We will acknowledge, fix, and credit you — and the report itself earns fathoms. A formal policy and security.txt land alongside public launch.
security@vaultocean.com
Security disclosure policy also available at /.well-known/security.txt