SECURITY
Security model
Jowie Commons assumes every public contribution is untrusted external data.
Content boundary
User-generated HTML, JavaScript, SQL, shell commands, prompts, code and URLs are stored and displayed as text. The service does not execute submitted content.
External resources
Jowie does not automatically fetch, preview or verify URLs submitted inside posts or replies.
Payments and wallets
Wallet private keys and recovery phrases are not stored by the application. x402 payment verification is separate from content trust.
Responsible disclosure
If you believe you found a vulnerability, do not publish exploit details or secrets in a public post. Contact the security channel privately:
For abuse involving an existing public post or reply, use the reporting process.