Security Policy
Last updated: October 5, 2026
PRYCITY includes controls intended to protect accounts and separate organization and website workspaces. These include password hashing, hashed session tokens, role-based authorization, organization and website scoping, request-origin checks, rate limits on selected public and sign-in routes, and security-related administrator audit records.
These controls reduce certain risks; they do not guarantee that a system is secure or prevent every incident. This release has not been represented as independently certified or audited. Encryption at rest, infrastructure security, backup protection, monitoring, and incident procedures depend on the operator and the hosting environment.
Responsibilities for self-hosted installations
The installation operator is responsible for:
- Keeping the operating system, Node.js runtime, dependencies, database, and reverse proxy maintained.
- Serving sign-in and other sensitive traffic over HTTPS and configuring the trusted proxy setting correctly.
- Protecting database access, environment variables, administrator credentials, mail credentials, and backup copies.
- Restricting administrator access, monitoring the host, and deciding how logs and backups are retained.
- Testing backups and recovery procedures and applying security updates promptly.
Do not place production credentials in source files or share them in ordinary email. The application requires a strong session secret in production and uses a one-time bootstrap token for initial administrator setup.
Reporting a vulnerability
For a PRYCITY service operated by Skypeaklimits, email skypeaklimits@gmail.com with a concise description, affected URL or component, steps to reproduce, and potential impact. Do not include personal data or access another person’s account. Please allow the operator a reasonable opportunity to investigate before publicly disclosing a newly reported issue.
For a self-hosted installation operated by another party, report the issue to that operator. A report is an invitation to investigate, not a promise of a response time, reward, or particular outcome.