Security & reporting

Report a problem privately

Email decisionjar@albibi.app with “Decision Jar security report” in the subject. Include the affected page, browser, steps to reproduce, likely impact, and a minimal example using invented data.

Do not include passwords, access tokens, someone else’s data, or your complete jar backup. If you encounter another person’s data, stop and report only what is necessary to explain the issue. This address is monitored by Albibi Power Partners LLC; there is no guaranteed response time or paid bug bounty.

What protects this version

• Jar contents stay in browser storage; there is no app database or upload endpoint.
• Imported backups have size and structure limits. User text is escaped before display.
• Draws use the browser’s cryptographic random generator with equal chances among eligible entries.
• Application scripts load from this site. The app’s content policy blocks external connections and inline scripts.
• There are no third-party runtime packages, analytics, or remote fonts.
• Data export and confirmed deletion are available in Your data.

What this does not guarantee

A code review and tests cannot guarantee an app is free from vulnerabilities. Browser storage and downloaded backups are not encrypted by the app. Device compromise, browser extensions, hosting security, and access to your browser profile remain outside these app controls.

The app is publicly accessible, but your saved jars are local to this browser profile. Anyone using that profile can see them; public access does not upload your jars or create separate encrypted storage for different people. Read our privacy notice before saving information.

Keep testing respectful

Use your own jars and invented data. Do not test other people’s accounts, disrupt the service, send bulk traffic or email, or probe the hosting platform or email providers through this app. Report platform issues through those providers’ reporting channels.