Security

Report a problem

Found a vulnerability in this site or in one of the tools? Please write to support@houjun.dev with the subject “Houjun Tools security” before telling anyone else, and do not open a public issue for it. Say what you found, how to reproduce it, and which tool and app (ChatGPT or Claude) you used. We will acknowledge your report, keep you informed, and credit you when it is fixed if you wish. There is no bug bounty.

Machine-readable contact: security.txt; this page is the policy it points to.

This website

• Static pages only. No scripts run on any page, nothing is loaded from third parties, and there are no forms, logins or cookies.
• Strict browser rules. Every page is served over HTTPS with a content security policy that forbids scripts, plus HSTS, no-sniff and framing protections.
• Read-only. The server accepts only page requests (GET and HEAD); anything else is refused.
• Nothing private is served. Notes, data files, code, archives, keys and hidden files are refused even if one were uploaded by mistake, and folders cannot be listed.

The tools

• QuietRepo signs you in with OAuth 2.1 (PKCE), issues its own tokens to the AI app and never passes your GitHub token on. It stores tokens only as hashes, reaches only the one repository you choose with short-lived GitHub App tokens, and refuses edits to notes that changed since they were read. Its server does not log requests or store note content.

Last updated 4 October 2026.