How we protect it

Security

Last updated: 4 July 2026

Pinpoints is built for sharing unreleased client work, so keeping previews private is the whole point. This is how the protection works.

Access

Unguessable links. Previews are served behind random tokens, marked noindex, nofollow, and frame-locked against clickjacking. Links can be revoked or set to expire at any time.
Per-account isolation. Every query is scoped to the owning account. One account can never read another's previews or feedback.
Sessions. Owner sign-in uses HMAC-signed, HttpOnly cookies. Passwords are stored as salted PBKDF2 hashes, never in plain text.

Abuse resistance

Rate limits on sign-in, sign-up, feedback, replies, sign-offs, screenshots and password resets.
Password reset links are single-use, expire after one hour, and are stored hashed.
Upload size caps and input validation on every public endpoint.

Source protection

Optionally, hosted previews serve a mangled variant of their inline JavaScript so rendered work can be reviewed without handing over clean, rebuildable source.

Infrastructure

Everything runs on Cloudflare's edge (Workers, D1, KV) over HTTPS with modern security headers (CSP, nosniff, referrer-policy) on every page we serve.

Reporting

Found something? Tell us first: aldo@uxconstellation.com. We take reports seriously and respond fast.

Pin it. Approve it. Ship it.