How secure is Romp?
We're a security product, so we publish our own posture. Below: the latest auto-scan of romp.domainless.fun, plus links to independent verifiers you can check yourself.
—
Loading latest scan…
Security headers
Surface probes
TLS
Verify with third parties
Don't trust our self-report — click these to see independent grades in real time:
Operating principles
- Eat our dogfood. Every Romp release is auto-scanned by Romp before it ships. This page is part of that.
- Cookies are
HttpOnly+SameSite=Strict+Secure. JWT access tokens never leak to JavaScript. - Passwords are scrypt-hashed with N=32768, r=8 (OWASP-recommended). Never logged. Never reversible.
- License tokens are ed25519-signed for offline verification. The matching public key is published at
/v1/auth/public-key.pem. - Stripe webhooks are signature-verified with idempotency via processed-event tracking. IP allow-lists are explicitly avoided — Stripe rotates IPs; signature is authoritative.
- Scanners run in restricted systemd units with
NoNewPrivileges,PrivateTmp,ProtectSystem=strict. - Rate-limited per tier — Free: 5/hr, paid tiers: 1000/hr. Burst protection on every API path.
- Find a vulnerability? Email privacy@domainless.fun — we respond inside 48 hours.