EmGee.dev / Security
Security
How we look after the servers, the apps and the data in them. Each project's own page adds what is specific to it. Last updated 3 November 2026.
Hosting
- Servers at BinaryLane in Melbourne, on a private network of their own. Apps, WordPress, databases and backups each run on separate servers.
- Public sites sit behind Cloudflare. Only Cloudflare can reach the web servers (Authenticated Origin Pulls with our own certificate), and traffic is encrypted all the way to the server (Full strict TLS).
- Firewalls deny everything by default: only HTTPS from Cloudflare and our private WireGuard network are open. SSH is key-only, over WireGuard, with fail2ban.
- Each app runs as its own system user with a locked-down systemd service (read-only system, no new privileges, memory limits).
Data
- Databases (PostgreSQL, MariaDB) live on a separate server that is not reachable from the internet, over encrypted connections.
- Nightly backups with restic, encrypted on the server before they leave it, kept on our own backup server and off-site in Cloudflare R2, where they are locked against deletion for 30 days. A restore is rehearsed every month.
- Passwords are stored only as slow salted hashes; where an app offers it, sign-in is by passkey (Face ID / Touch ID) instead.
- API keys and secrets are encrypted at rest (sops and age), never kept in code, and rolled from one place.
Keeping current
- Operating-system security updates install automatically; the servers are on Ubuntu Pro.
- App dependencies are audited every hour; security fixes are applied the same day.
- Every release is tested, then health-checked when it goes live, and rolled back automatically if it fails.
- A monitoring grid watches every server, site, certificate, backup and app, and tells us within minutes.
In the apps
- Strict Content Security Policy, HSTS, and the usual browser protections on every page.
- Rate limits and lockouts on sign-in.
- Payments are handled by Stripe or PayPal: card numbers never touch our servers.
- Least privilege for keys: each one can do one job, from one server.
Reporting a vulnerability
Email security@emgee.dev with what you found and how to reproduce it. We acknowledge within 2 business days, keep you posted, and credit you if you would like. Please don't access other people's data, degrade a service or publish details before a fix. We won't pursue good-faith research that follows these rules. Our security.txt has the same details.
If something goes wrong
If a breach is likely to cause someone serious harm, we notify the people affected and, where the Notifiable Data Breaches scheme applies, the Office of the Australian Information Commissioner, and tell clients straight away.