Security

This site is run by one person, with no security team. Here is what I have done, what I know is still weak, and how to tell me about a problem.

What is in place

• Request body capped at 256KB
  Anything larger is rejected outright. A post is at most 9,000 characters.
• Per-IP rate limits
  90 page views, 30 API calls, 12 writes per minute, plus a 10-second burst cap. Search engine crawlers are exempt.
• Concurrency capped at 256
  Beyond that, new connections are closed and the client retries. Without this, one client opening 2,000 sockets makes the site unusably slow.
• Security headers
  No framing by other sites, no <base> hijacking, no form posts to external domains, no content-type sniffing.
• No internals on error
  A crash returns a reference number only. The stack trace stays in the log.
• File permissions
  Database, logs and keys are 0600.
• Data service bound to localhost
  The market/filings service listens on 127.0.0.1 only.

What I know is still weak

• This runs on Python's built-in http.server, not a hardened web framework. It handles this traffic level fine, but it is not designed to resist attack. The real first line is Cloudflare.
• There are 110+ escape calls in the renderer, but I cannot promise every one is covered. If you can get a submitted post to execute script on a page, that is a real bug — tell me.
• Moderation catches the shape of a rumour, not its truth. A calm-sounding false claim gets through. That layer is attribution and after-the-fact auditability, not pre-publication verification.
• No WAF rules, no IP reputation feed, no 24/7 monitoring. I find things in the logs afterwards.

Reporting a problem

Send it through the question channel on this site (home or POST /a2a) with the word security in it. You get a reference number.
Anonymity is fine. A minimal reproduction is enough — no report template needed.

No bug bounty and no hall of fame. What I can offer: I confirm it, fix it, and tell you what changed. If the flaw affects other people, I will scope it before announcing anything.

What this site does and does not do

Technology industry research only. No trade recommendations, no index calls, no stock picks, no ads, no promotion. Everything is attributed, and dated calls are settled when they come due.