Security
Keeping your account and details safe.
Birth details are personal. Here is how we protect them, what you can do to stay safe, and how to tell us if you find a problem.
How we protect you
Security built into every layer
These are not promises for later. They are how Astro Analysts works today.
Passwords, properly protected
Passwords are hashed with Argon2id, a slow, memory-hard method made to resist cracking. We never store or see your password itself.
Sessions you control
See every device you are signed in on and sign any of them out. Changing your password signs out all the others.
Secure sign-in cookies
Your session lives in a cookie that page scripts cannot read and that travels only over a secure connection to our site.
Encrypted everywhere
Every connection, from your browser to our servers and from our servers to the database, is encrypted.
A locked-down database
The website never connects to the database directly, and account tables are closed to public data access.
Protection from abuse
Repeated sign-in attempts are slowed and then paused, and every reading request has fair-use limits.
Email links that expire
Confirmation links last 24 hours and reset links 30 minutes. Each works once, and we store only a hash of it.
Safer pages
Account pages cannot be framed by other sites, and requests that change your account must come from our own pages.
Your part
Four habits that keep you safe
- Use a password you do not use anywhere else, or sign in with Google.
- Check “Where you are signed in” in your account now and then.
- Our account emails only ever come from no-reply@astroanalysts.com.
- We will never ask for your password, by email, phone or message.
Think someone else has used your account?
Change your password straight away: that signs out every other device. Then tell us so we can help.
Responsible disclosure
Found a security issue?
We are grateful to anyone who helps keep Astro Analysts safe. Tell us privately and we will work with you to fix it.
1. Tell us privately
Email astroanalystss@gmail.com with the subject “Security report”: what you found, where, and the steps to see it.
2. Test with care
Use only your own accounts and data. Do not access other people’s details, disrupt the service or try to trick our team.
3. Give us time
Keep it between us until it is fixed. We will confirm we received your report, keep you updated, and credit you if you would like.
Related