Security
How uier.io protects the comments left on it, and how to report a problem. The code is open source, so you can check how it works.
Report a vulnerability
Email security@signalco.io. Please do not open a public issue for a security problem.
What to send
What you found, the steps or a request that reproduces it, and the impact you expect. A page address or a comment id helps.
We will investigate every legitimate report and do our best to fix the problem quickly.
While you test
Test with your own comments only. Do not read, change or delete other people’s comments, do not overload the service, and do not post personal data.
In scope: uier.io, its comments API, /toolbar.js and the code in the repository.
How uier is protected
The controls that are in place today.
Encrypted in transit
uier.io is served over HTTPS only, with HTTP Strict Transport Security, so browsers never fall back to plain HTTP.
Locked-down pages
A Content Security Policy limits where scripts and connections can go. Pages cannot be put in frames, and browsers do not guess content types.
Anonymous identity
Your first comment sets a random 256-bit token in an HttpOnly, Secure, SameSite=Lax cookie. The server stores only its SHA-256 hash. Guest names are derived with a server-side key, so nobody can forge one.
Author-only actions
The server, not the toolbar, decides who may resolve, reopen or delete. Only the author of a comment or reply can, and deleting your comment never removes replies from other people.
Same-origin writes
The comments API accepts writes only as JSON from pages on its own origin. Cross-site requests are rejected.
Bot protection and rate limits
Every write is checked by Vercel BotID. New comments and replies are limited per visitor, per IP address and per page, with atomic counters that store only keyed hashes and expire after their time window.
Strict input, plain output
Requests are validated against strict schemas and size limits (16 KB per request, 1000 characters per comment). Comments are shown as plain text: no HTML, Markdown or links.
An isolated toolbar
The toolbar renders in its own shadow root, so it neither changes nor inherits the page’s styles. A comment with bad data renders nothing instead of breaking the toolbar.
Minimal data, short retention
The API never returns author ids, IP data or device details beyond the device size. Comments are deleted automatically 90 days after their last change.
Encrypted at rest, in the EU
Comments are stored in Azure Cosmos DB in the West Europe region, which encrypts all data at rest. Preview deployments use a separate container and cannot reach production comments.
No secrets in code
Keys live in the hosting environment, set by the infrastructure code. CI signs in to Azure with short-lived OIDC tokens instead of stored credentials, and the resources that hold data are protected from deletion.
Reviewed changes
Every change to production goes through a pull request with passing checks. Infrastructure is applied only by CI, and dependencies are pinned and updated by Renovate one day after release at the earliest.
Your data
What is collected, who processes it and for how long is in the privacy policy and the cookie policy. Comments on uier.io are public, so never put secrets or personal information in them.