Trust is a product requirement.

Platform safeguards

• Secure, HTTP-only session cookies and CSRF protection for sensitive account actions
• Rate limits on authentication, creation, reporting and owner operations
• Validated redirect destinations and reserved-route protection
• Private analytics authorization and owner-only operational controls
• Automated tests, migrations and health checks support release review

Responsible disclosure

Report a suspected security issue privately to account@sely.co with “Security disclosure” in the subject. Include affected URLs, reproducible steps, impact and supporting evidence.

Rules for research

• Use only accounts and data you own or have permission to test
• Do not access, alter, retain or disclose another person’s data
• Do not degrade availability, send spam or perform denial-of-service testing
• Allow reasonable time for investigation before public disclosure
• Do not use a vulnerability to demand payment or threaten disclosure

Scope and rewards

Submitting a report does not create a contract or guarantee payment. Sely does not currently operate a public bug-bounty programme. We may recognise high-quality reports at our discretion.

Account protection

Sely includes layered account controls such as secure sessions, sensitive-action checks and additional authentication capabilities where enabled. Session-management features are intended to help account owners review and end access when a device is no longer trusted.

• Use a unique password and do not reuse credentials from another service
• Enable stronger sign-in protection when it is available in your account
• End sessions you do not recognise and use logout-all after suspected compromise
• Keep recovery material offline and never send it to support

Redirect and abuse controls

Short links are useful because they hide long destinations, which also means they can be abused. Sely validates supported destination formats, protects reserved routes, rate-limits sensitive operations and provides an abuse-review path for phishing, malware, spam and other harmful use.

Operational security

Production releases are supported by automated tests and deployment checks. Private account data and owner operations require authorization, and sensitive operational routes are not intended to become public analytics surfaces.

Security has limits

No internet service can guarantee that every vulnerability, malicious link or automated attack will be detected in advance. Security reports that are reproducible, scoped and privately disclosed help us improve faster.