Security

Who looks after security

Garth Watson is Founder and Security Lead at The Doxa Way Ltd. He is accountable for the security of all products and services run by The Doxa Way Ltd, including Doxa and Wamemba me.

The Doxa Way Ltd is registered in England and Wales, company number 16744139. Read more about Garth.

Reporting a vulnerability

If you think you have found a security problem in anything we run, email Garth at garth@doxa.app. We welcome reports from security researchers and from anyone who notices something wrong.

Please include:

• what you found, and where (a URL, an app screen or an API endpoint)
• the steps to reproduce it
• what someone could do with it
• how we can reach you with questions

We aim to reply within a few working days, and we will keep you updated while we look into it.

Please act in good faith

• Give us reasonable time to fix a problem before you share it publicly.
• Only use accounts you own, or have permission to use. Do not access, change or keep other people's data. If you reach someone else's data by accident, stop and tell us what you saw.
• Do not degrade or interrupt our services, for example with denial of service or high-volume automated testing.
• Do not use social engineering, phishing or physical attacks against our team or the people who use our products.

We do not run a bug bounty, and we cannot pay for reports.

How we look after your data

• Doxa and Wamemba me are built on Supabase Postgres, with row level security turned on for every table. For every request from our apps, the database checks who may read or change each row.
• Our apps and websites talk to our servers over HTTPS. doxa.app sends a strict transport security (HSTS) header and a content security policy.
• When Doxa's database schema changes, automated checks confirm that its most important access rules are still in place.
• We scan the Doxa codebase for leaked secrets, and check its dependencies for known vulnerabilities, every week.
• doxa.app/delete-account explains how to delete your Doxa account and its data.

Scope

This policy covers all products and services run by The Doxa Way Ltd, including:

• doxa.app and its subdomains, including the Doxa web app (wisdom.doxa.app is hosted by Substack, see below)
• the Doxa apps for iOS and Android
• the Doxa MCP server at doxa.app/mcp, and Doxa on Discord and Telegram
• Scripture Grounding at doxa.app/scripture-grounding
• wamemba.me
• the APIs behind all of these

Some of what we use is run by other companies, such as Supabase, Vercel, Apple, Google, and Substack (which hosts wisdom.doxa.app). Problems inside their services belong with them. If one of those problems affects the people who use our products, we still want to hear from you.

Our contact details are also published in machine-readable form at doxa.app/.well-known/security.txt.