Security
Last updated
This is a marketplace where people who have never met negotiate money and exchange unreleased work. Here is what protects that.
Isolation is enforced by the database
Every query runs as the person making it, and Postgres row-level security decides what they may see. That holds even when application code has a bug, because the application is not the thing making the decision. Cross-tenant access is covered by a test suite that asserts those reads return nothing.
Accounts are checked before they can act
Our team checks every creator and every brand before it can make an offer, apply or send a message; a teammate joins a brand by its invitation. Until then the database refuses every change the account tries to make, whatever the page in front of it allows.
Agreed terms cannot be edited
Each counter-offer is stored as its own immutable version. A deal points at the version that was accepted rather than copying its numbers, so what was agreed has exactly one answer and cannot be rewritten afterwards by either side.
Conversations stay on the platform
Contact details are checked at the moment a message is written, inside the database rather than in the app, so no client can route around the check. An email address, a link to chat elsewhere or a messaging handle stops the message; a phone number is removed before it is delivered. A stopped message shows to its sender as not delivered and to nobody else; what the filter matched is logged for support to adjudicate a dispute. The filter is a deterrent, not a wall: it will miss some things.
Actions that matter are recorded
Offers, acceptances, deliverable reviews, payments and dispute resolutions all write to an append-only log. There is no update or delete path on it for anyone, including our own support staff. An audit trail that its administrators can edit is not an audit trail.
Money does not pass through us
Brands pay creators directly and record each payment here, with its date and reference. Recorded payments, like the log, can be added to but never changed.
Signing in
Creators sign in with X, so we hold no creator password, and we keep no access token to anyone's X account. Brands sign in with an email address and a password, stored by our auth provider as a one-way hash. Sign-in and reset links are exchanged for a session on the server, and only in the browser that asked for them, rather than left sitting in a URL.
Reporting a vulnerability
Email security@weekdays.gg with a description, reproduction steps and impact. We aim to acknowledge within three business days.
Please do not test against other people's accounts or live deals. Ask and we will provision you an isolated tenant with seeded data to work against. Anything else goes through the contact page.