Security

How we protect your data

• All traffic is encrypted with HTTPS, and our database and file storage, both on Cloudflare, encrypt data at rest.
• Card details never reach us: Dodo Payments, our merchant of record, takes the payment.
• Payment notifications are verified by signature, and we read each payment’s state from Dodo Payments rather than trusting the browser.
• Sign-in codes are stored only as hashes, and expired sessions and codes are deleted every day.
• Our database can be restored to any point in the last 30 days.

How we protect your account

• Sign in with an emailed code or with Google, so there is no password to leak.
• Each code works once, for 10 minutes, with 5 tries. Requesting one needs a bot check, and requests are rate-limited.
• Your session cookie is HttpOnly and Secure, so page scripts can’t read it and it only travels over HTTPS. Signing out ends the session.
• On a Business plan, the owner decides who holds a seat and can remove one at any time.
• MCP clients connect through OAuth 2.1 with your consent. Their tokens work only with the MotionVideo MCP server, and its tools are read-only.

How we protect the site

• Uploaded images are checked by their content, not their name: only PNG, JPEG, and WebP within a size limit, and never SVG.
• Every sponsorship, job post, and submission is reviewed before it goes public.
• Forms and uploads are rate-limited per IP address.
• Only a short list of administrator accounts can open the review tools.
• The website’s source code is public on GitHub, so anyone can read how it works.

Report a vulnerability

If you find a security issue, report it privately through GitHub Security Advisories or write to hello@motionvideo.xyz. Please give us time to fix it before you share it, and do not access other people’s data while you test.