Trust
Security
WhoOwnsWhat.xyz tracks who controls your project. It shouldn't become a new way to lose control of it. Here's how we're designing it.
The app is in development. These are the principles we're building to, not an audit report.
What we will never do
- Store your passwords. We record who owns and controls an account, not how to log in to it.
- Hold your money. Settling up happens directly between teammates through Revolut, PayPal or Wise.
- Ask for more access than we need. Connections to GitHub, Vercel or registrars will be read-only where the provider allows it.
How we build
- Encrypted connections (HTTPS) everywhere.
- Strict browser security headers on this website, including a content security policy.
- Every project's data visible only to that project's members.
- Secrets kept out of code and out of the browser.
Report a vulnerability
Found something? Email hi@whoownswhat.xyz with steps to reproduce. Please give us reasonable time to fix it before sharing it publicly. We'll reply as fast as we can and credit you if you'd like.
Our security.txt has the same contact details.