Reporting a vulnerability
Email hello@thecompound.tech. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.
Accounts
StoreReady has no user accounts. There is nothing to sign in to, no password to reset and no session to steal. The site is a published dataset and a set of static pages, and a build gate fails the deploy if an authentication route ever appears while this page still says otherwise.
What is stored
- An email address, only if you type one into the subscribe form, and only after you confirm it by clicking a link.
- Anonymous page analytics with the IP address truncated before it is stored.
Who else processes data
- Vercel, hosting and edge delivery; request logs.
- PostHog, product analytics, IP-truncated.
- Resend, delivering the one email the subscribe form sends.
Also true
- Everything on this site is generated from public sources and rendered as static pages; there is no user-generated content that another visitor can see.
The declarations on this page are part of this product’s own configuration and are re-checked at every deploy against the tree they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.