LEGAL
Security
Last updated: 2 July 2026 · Applies to app.nullcorp.eu and every tool hosted under it
This page describes what we actually have in place, verified against the real, deployed system rather than written as a generic promise.
HTTPS
All traffic to app.nullcorp.eu is served over HTTPS. Plain HTTP requests are redirected automatically (verified: an HTTP request returns a 301 redirect straight to the HTTPS version).
Password security
Passwords are hashed with bcrypt before storage — we never store or can read a plaintext password. Minimum length is enforced at registration. If you use Google Sign-In instead, we never see or store a password at all for that account.
Authentication
Sessions use random 64-byte tokens, expiring automatically after 30 days, stored server-side and checked on every authenticated request. Tokens are revoked immediately if you request account deletion. Email verification is required before an account can sign in. Admin access is gated by a separate key, checked on every admin request.
Secure data storage
Database credentials, third-party API secrets (Google OAuth, Cloudflare Turnstile, SMTP, Pusher, the AI-editor key), and the admin access key are stored in a server-side configuration file, not hardcoded in the application source — that file is blocked from direct web access. This wasn't always the case: earlier in development these values lived directly in the PHP source files. We treated that as a real gap, not a footnote — it was fixed as part of this Security page's own preparation, not just written around.
Backups
We target a 30-day rolling backup retention through our hosting provider. This is a hosting-level setting, not something our own application code manages or can independently verify — stated honestly as a target rather than a guarantee we've directly confirmed.
Monitoring
Login and registration attempts (IP address, timestamp, outcome) are logged for 1 year, automatically purged after that window by the same daily maintenance job that runs account deletions. To be precise about what this actually is: it's a record we can manually query if abuse is suspected, not an automated detection or alerting system — nothing currently scans it proactively or flags patterns on its own. Registration is additionally protected by Cloudflare Turnstile bot-detection, and login/registration attempts are rate-limited per IP.
Responsible disclosure
If you find a security vulnerability in NULL TOOLS or any tool hosted on it, please report it privately to contact@nullcorp.eu before disclosing it publicly. Include enough detail to reproduce the issue. We'll acknowledge reports and work on a fix; we ask that you don't access, modify, or delete data beyond what's needed to demonstrate the issue, and don't run automated scanning that could disrupt the service for other users (see our Acceptable Use Policy).