Accounts and access
- Passwords are stored as salted scrypt hashes; repeated wrong guesses are slowed down.
- Shortcut and API tokens are stored only as SHA-256 hashes, shown once, and can be revoked individually.
- New accounts can require owner approval, and roles (owner, admin, member) control who can manage users.
Your data
- Every database query is scoped to the signed-in account, so one person can never read another's saves.
- Row-Level Security is enabled on every table, blocking direct access through the database provider's public API.
- All traffic uses HTTPS. Password hashes never leave the server.
Fetching links safely
When Duet reads a page you saved, it only follows public web addresses, refuses private and internal network addresses, limits redirects, time and size, and identifies itself honestly as a link-preview fetcher.
Email actions
Open, Snooze and Done buttons in reminder emails use signed links that expire after 14 days and act only on that one save.
Reporting a vulnerability
Found a problem? Email maazz.dev@gmail.com with steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and don't access other people's data while testing.