Privacy
What this blog stores, why, and the choices you have.
Updated
Analytics
Limited site statistics are enabled by default. This setting applies to this browser, independently of your account.
On for this browser.
Do Not Track and Global Privacy Control are respected automatically.
Who runs this site
bugs.exposed is a security research blog run by Nikita Markevich. Contact Nikita on LinkedIn for questions about your data.
What is stored
- Accounts and passkeys
- Your chosen name, public passkey credentials, device labels and sign-in records. Your private key and biometrics stay outside this blog.
- Comments and reactions
- Comments attached to selected text, displayed name, avatar, date, replies and reactions, with an account or anonymous identifier.
- Saved articles and reading positions
- Stored in your browser for guests; synced to your account when signed in. Includes preferences and up to 20 recent article positions. Guest bookmarks may be imported at sign-in.
- Email updates, if you subscribe
- Your email address, subscription choices, confirmation and delivery records. Every notification includes an unsubscribe link.
How analytics works
The blog measures public page views, reaching the end of an article, source category, device, browser and approximate country. Analytics is enabled by default; you can turn it off above.
A daily cookie-derived hash deduplicates each browser, page and UTC day. It is pseudonymous. Analytics does not store account IDs, raw IPs, full referring URLs, search queries or raw browser strings. Only the owner sees reports.
No advertising trackers or sale of visitor data. Known bots and the signed-in owner are excluded.
Cookies and browser storage
| Cookie | Purpose | Lifetime |
|---|---|---|
cs_session | Keep you signed in. | 7 days |
cs_challenge, cs_passkeychallenge | Complete a passkey sign-in or account security check. | 5 minutes |
cs_appearance | Apply your account appearance before the page loads. | 7 days |
cs_color_mode | Remember your Light or Dark override in this browser. Removed when you choose System. | 1 year |
cs_visitor | Recognise an anonymous commenter and help prevent abuse. Also used to derive a daily analytics identifier when analytics is enabled. | 1 year |
cs_analytics | Remember your analytics setting. It contains your choice, not a unique visitor ID. | 1 year |
These cookies are inaccessible to page scripts. Browser storage also holds preferences, bookmarks, reading positions and drafts. Local copies can remain after sign-out; clear site data on shared devices.
How long data stays
- Accounts, comments, reactions and bookmarks remain until removed or a deletion request is handled. Hiding a comment does not erase it.
- Reading positions expire after 90 days; expired account rows are removed on subsequent saves. Browser copies may remain.
- Analytics deduplication keeps the current and previous UTC day; daily summaries cover a rolling year. Cleanup runs in small batches during visits: deletion is not guaranteed at an exact hour. All-time article totals remain.
- Unsubscribing stops future emails but retains the address and subscription state. Ask separately for deletion.
- Expired sign-in records become unusable. Existing backups may retain copies until replaced or removed.
Hosting, email and external content
OpenAI Sites and Cloudflare host the blog and process network information, including IPs. The app also uses hashed network identifiers to prevent abuse. Provider logs, backups and international processing follow their own arrangements.
Enabled email delivery uses Resend or Cloudflare, which receives your address and message.
External comment images contact their hosts directly, exposing your IP to them. External links lead to services with their own privacy practices.
Why data is used
To provide account and reading features, prevent abuse, moderate discussions and understand readership. Emails are sent only when you subscribe.
Your choices and requests
Manage analytics above, bookmarks and reactions on the site, and email subscriptions through unsubscribe links. For access, correction or deletion, Contact Nikita on LinkedIn. Include your account name or comment link. Verification may be needed; never send private passkey material.
Account removal does not automatically erase public comments; mention those separately. Depending on applicable law, you may also request restriction, objection or portability, and complain to your data protection authority.