Transport security
Connections use HTTPS and certificates issued for the active hostname.
Minimal attack surface
No database-backed login, upload form or third-party script.
Responsible reporting
Security issues may be reported to the base-domain security contact.