A small site.
A clear responsibility.
Updated
The Sanford Labs publisher site is a static directory of our software products. It has no accounts, payment processing or customer database. Sanford Labs LLC operates it on OVH infrastructure in the United States. This page describes this site’s safeguards and how to report a security concern.
What runs here
Astro generates static pages, served by Caddy behind an HTTPS proxy. Hosting is in Hillsboro, Oregon, United States. The site uses a restrictive Content Security Policy, HTTPS redirects, HSTS, and protections against framing and content-type sniffing.
Deployments use a container image tagged with its source commit. Staging is deployed before production; the same image is used for both. The site’s version endpoint identifies the deployed commit.
What data this site handles
Cookieless page analytics use PostHog US Cloud through a first-party proxy. The marketing configuration disables automatic interaction capture and session recording. This site does not offer sign-in, take payments, or receive product uploads.
Our privacy policy explains server logs, email, retention and data locations. Product accounts and their data are covered by each product’s own policies.
Report a vulnerability
Use our security contact form with the affected URL, what you observed, and steps to reproduce it.
Keep reports private while we investigate. Do not include passwords, access tokens or other people’s data in your message. We do not publish a guaranteed response time or offer a paid bug bounty.
Each product has its own scope
The publisher site’s safeguards do not establish the security capabilities of every product. Availability, authentication, storage and integrations vary. Start with the product directory and consult the relevant product’s security and privacy information.