If you find a security problem in Techichi, write to hello@techichi.app with what you found, where it is, and how to see it again. Every report is read and answered, and a confirmed problem is fixed before other work; the person who reported it is told when the fix is out, and thanked by name if they wish. While looking, use only your own account, and do not read, change or keep anyone else's data or slow the service for others. Give us a fair chance to fix a problem before telling anyone else. There is no paid bounty.
What is in place. Sign-in is handled by a dedicated sign-in service; Techichi never sees a password. Every row in the database belongs to an account, and the database enforces that boundary itself; the functions that read and write it are reviewed and tested against a second account before every release. Requests are limited at the edge and in the database. Every write to your record, and every read of it through an API key, is logged where you can see it. Backups are made nightly and encrypted, and a test restore of one is run every month from November 2026. Dependencies are audited before each release and updated monthly, and secrets are scanned before any code is published. A written model of what Techichi holds and how it is protected, and a runbook for incidents, are kept current, and a professional test is planned when revenue allows. During the beta, API keys are issued to the operator's account only.