Security
How this site, and the products it presents, treat security.
Last updated 8 October 2026
1. This site
The public site has no visitor accounts and no server-side session; its database holds only the site's own text and a daily record of each product's public engineering tracker, nothing about visitors, and visitors can only read it. The single server function handles the contact form, validates input, rejects automated submissions with a honeypot field, and forwards the message by email. No secrets are shipped to the browser; the email provider key lives only in the hosting environment.
2. The products
Each product is built with security as a baseline: strict separation between customers' data, server-side checks that never trust a client-supplied identifier, encrypted credentials, an immutable audit trail for consequential actions, and rule-based (non-LLM) authorisation. Each product describes its own controls in more detail; ask us for specifics during diligence.
3. Reporting a vulnerability
If you believe you have found a security issue in this site or any Wonder product, please report it through the contact form and mark it as a security report, or email connect@wonderapps.biz directly. We will acknowledge promptly and keep you informed. Please do not test against production tenants that are not yours.