Security Policy

PivotHero enforces HTTPS, hashes passwords with Argon2id, uses secure server-side sessions, applies CSRF protection and rate limiting, and validates every upload's extension and MIME type.

If you discover a security vulnerability, please report it to security@getpivothero.com rather than disclosing it publicly.