Security

If you have found a security problem, please report it before disclosing it publicly. Write to kontakt@zerogov.lol with enough detail to reproduce it — the request, the response, and what you expected instead.

Trimly is run by one person in their own time, so there is no bounty programme and no payment for reports. What there is, is a direct line to whoever will fix it.

Testing against your own account is welcome. Please do not test in ways that degrade the service for others, access data belonging to anyone else, or run automated scanners against the redirect engine — it is the part people depend on. Report in good faith and no legal action will be taken over your research.

Passwords are hashed with scrypt, a memory-hard function that makes bulk cracking expensive, at a cost of roughly 32 MB per attempt. The plain password is never stored and cannot be recovered — only reset.

Two-factor authentication by authenticator app is available on every plan, including the free one. The shared secret and your recovery codes are encrypted at rest, so reading the database alone does not defeat it.

A sign-in issues a short-lived access token alongside a refresh token that is exchanged for a new one each time it is used. If an already-exchanged refresh token is presented again — the signature of a stolen token — the whole session family is revoked immediately and the event is recorded. Every active session is listed in your settings and can be revoked individually.

Sign-in attempts are rate limited far more tightly than ordinary requests, and repeated failures lock the account temporarily rather than allowing an endless guessing run.

Everything is served over HTTPS, and browsers are instructed to refuse plain HTTP for this domain in future. Certificates renew automatically.

Requests that change your data must carry a token that only this site can read, so another site cannot make them on your behalf while you are signed in. Responses carry a content security policy, and the API accepts cross-origin requests only from the web app.

Database queries are parameterised throughout, including the analytics aggregates that take filters from the URL.

A destination must be an ordinary http or https address. Anything else is refused — including addresses pointing at private networks, loopback, link-local ranges and internal hostnames, which would otherwise turn the redirect engine into a way to probe the infrastructure behind it.

Links can be protected with a password, given an expiry date, or capped at a number of clicks. Redirects are served with caching disabled, so a click is counted rather than silently repeated from the browser's cache.

A link removed for abuse cannot be reinstated from within the workspace that created it. That is deliberate: a takedown a workspace administrator could undo would not be a takedown.

The IP address of someone clicking a link is never stored. It is hashed together with a salt that changes daily, so visitors can be counted for a day and not tracked beyond it. The details are in the Privacy Policy.

Application servers and the database are in the European Union. Administrative actions are written to an audit log.

Worth knowing before you rely on Trimly for something that matters, because a page listing only strengths tells you nothing:

• no SOC 2, ISO 27001 or comparable certification, and no external audit of any kind;
• no independent penetration test;
• no guaranteed uptime outside an Enterprise agreement, and no on-call rotation — this is one person;
• no signed data processing agreement offered as standard; ask if you need one and it can be discussed;
• no formal disaster recovery plan beyond the managed database provider's own backups.

If your use needs any of these, say so before you build on it rather than after.