Security

Hosted sites live on a separate domain

Sites are served from flatpage.page, a different domain from the website and dashboard you sign in to. Each site gets its own subdomain, such as your-site.flatpage.page. Because browsers isolate domains from each other, JavaScript on a hosted page can't read your session cookie or act on your account, and it can't reach other people's sites either.

Every link uses HTTPS. Custom domains get their own certificate when they're verified.

Accounts

• No passwords to steal: you sign in with a one-time email link or with Google.
• An email address must be verified before anything can be published, and sign-in and uploads pass a human check (Cloudflare Turnstile).
• Sessions are stored as hashes, expire after 30 days, and end immediately when you sign out. Session cookies are HTTP-only and never sent to hosted sites.
• Limits on uploads per day slow down anyone trying to abuse a single account.

Every upload is checked

• Virus scan. Files are scanned with ClamAV before they go live. Infected uploads are rejected.
• Zip safety. Archives are checked for path tricks and zip bombs, and only file types that belong on a static site are published.
• Link reputation. Links inside uploaded pages are checked against Google Safe Browsing. Pages linking to known phishing or malware sites are held offline for review.
• Phishing detection. Pages on the free plan that contain login or payment forms, especially ones imitating well-known brands, are held for review before anyone can see them.
• Immutable versions. Once published, a version can't be changed, only replaced by a new one. Each version keeps its scan result.

Reports and takedowns

Anyone can report a hosted site at its /_dropsite/report address, and free sites show a Report link. Sites reported by three different people go offline automatically until we review them, and suspended sites stop serving at once. Every hold, takedown and restore is recorded in an audit log. See the acceptable use policy for details.

Infrastructure

• Runs on Google Cloud, behind Cloudflare.
• Uploads go directly to storage through short-lived signed URLs; published sites are stored separately from raw uploads.
• Payments are handled by Stripe. Card numbers never touch our servers.
• Secrets are kept out of the code and only available to the services that need them.

Reporting a vulnerability

If you think you've found a security problem in Flatpage, email [email protected] with the steps to reproduce it. We'll acknowledge your report within three working days and keep you updated until it's fixed.

Please:

• Test only against your own account and sites.
• Don't access or change other people's data, and stop if you reach any.
• Don't run denial-of-service tests, spam, or social engineering against us or our users.
• Give us reasonable time to fix the issue before you share it publicly.

We won't take legal action against research done in good faith within these rules, and we're happy to credit you once the fix is out.

To report a malicious site hosted with us rather than a bug in the service, use the site's report form instead; it's faster.