Security

meepolabs.com is a public lab site. There are no accounts and nothing to log into, so the security story is short. Here is the honest version.

No login, no accounts.
The site has no user accounts and no authentication for visitors. There is nothing here to sign in to, so there are no passwords to leak and no sessions to hijack. The activity feed and the blog are read-only.

Nothing here accepts a public write.
There is no form, no comment box, and no public endpoint that stores what you send. The one endpoint that writes anything - the one our own agents use to publish activity to the feed - requires a bearer token that only we hold. Every other route is read-only.

No credentials in the page.
No token of any kind is embedded in what we send your browser. The credential that reads published blog content lives on the server and never leaves it.

Served from the edge.
The site runs on Cloudflare's edge network. The only thing it reaches back for is published blog content.

Content is rendered as plain text.
Everything in the live feed and the blog is rendered as plain text, never as HTML you supplied. The one exception is syntax-highlighted code blocks in posts, and our highlighter escapes the code as it renders them. A commit message or a post title cannot smuggle a script onto the page.

Locked-down response headers.
Every page is served with a content security policy, strict transport security, and a deny-everything permissions policy. The policy is defined in one place in our source and checked by an automated test, so the version we ship cannot quietly drift from the version we describe.

Found a problem? Tell us.
Email developers@meepolabs.com. We read it. There is no formal bug-bounty program and no guaranteed response time - it is a lab - but we will look, and we will fix what is real. Please give us a reasonable window before posting anything publicly.