Security

Transport security

All traffic to OnlySearcher is served exclusively over HTTPS with modern TLS configurations. The site enforces Strict-Transport-Security so browsers will not connect over plain HTTP after the first visit. Standard security headers are applied at the reverse-proxy layer: X-Content-Type-Options to prevent MIME sniffing, X-Frame-Options to prevent click-jacking through iframes, Referrer-Policy to limit referrer leakage, and X-XSS-Protection for legacy browser hardening.

Data minimization

OnlySearcher does not collect personal information from visitors, does not run user accounts, and does not store passwords or payment information. The data the site processes is limited to what is operationally necessary: standard access logs for security investigation, aggregate analytics for traffic patterns, and the public creator data the site indexes.

The absence of an account system removes a long list of attack vectors entirely — credential stuffing, password reuse exposure, account-takeover phishing, session-token theft, and OAuth-token misuse all become non-applicable when there are no user credentials in the first place.

Account-less architecture

Saved creators, on-site preferences, and any other personalization signals live entirely in the visitor's browser using localStorage. No server-side store of per-visitor activity is maintained. The site continues to function with cookies and localStorage cleared between visits — the visitor will simply see a fresh state.

Operational dependencies

Selected operational dependencies — hosting, content delivery, image proxying, and aggregate analytics — process data strictly to operate the service. These providers are selected with documented security postures, reviewed periodically, and given access only to the data their function requires. Provider lists and the data each provider sees are documented in the Privacy Policy.

Image proxying

Avatars and cover images displayed on OnlySearcher are routed through an image proxy with a long edge cache. The proxy strips referrer headers on outbound fetches and serves transcoded images in modern formats. This both reduces load on the source platform and prevents the source platform from seeing per-visitor referral data when an image is loaded inside an OnlySearcher page.

Responsible disclosure

A responsible-disclosure flow is in preparation. Once published, it will define:

• The in-scope domains and which surfaces are covered by the program.
• Acceptable testing methods and the explicitly out-of-scope behaviors (denial-of-service, social engineering of staff or third parties, physical attacks).
• The expected acknowledgment window and the expected resolution window per severity tier.
• A safe-harbor commitment for good-faith research that follows the published rules.
• The submission channel and the published PGP key for sensitive reports.

Until the flow goes live, no public security-report channel is published on this site.

Out of scope

Pages that intentionally describe stub functionality, third-party platforms reachable via outbound links from creator listings, and social-media surfaces linked from creator profiles are outside the responsible-disclosure scope for OnlySearcher. Issues found on those surfaces should be reported to the operator of the surface in question.

Hardening roadmap

The next batch of work tracked under the security program covers: a published Content-Security-Policy that further restricts script and connect-source origins, Subresource Integrity for the small set of cross-origin scripts the site loads, and a documented vulnerability-disclosure timeline including coordinated-disclosure windows. These items are tracked internally and will be reflected on this page as they ship.