Passwordless accounts
Verified email links and passkeys avoid reusable product passwords. Sessions and passkeys can be reviewed and revoked.
Loading St. Nick's List
St. Nick's List minimizes credentials, separates recipient and giver data, and treats household, child, teen, and address access as explicit authorization decisions.
Verified email links and passkeys avoid reusable product passwords. Sessions and passkeys can be reviewed and revoked.
Exports, deletion, guardian changes, ownership transfers, and identity transitions require a recent user-bound verification proof.
Sharing grants use high-entropy secrets stored only as hashes. They can expire, have use limits, and be revoked immediately.
Recipient-safe database and API projections omit giver activity rather than relying on front-end hiding.
Address details are field-encrypted, private tables use row-level access rules, and security evidence avoids raw tokens and contacts.
Send a clear description, affected page or feature, reproduction steps, impact, and a safe proof of concept. Do not access another person's data, disrupt the service, or include live private links and credentials.
security@stnickslist.comThis page does not promise a bug bounty or authorize destructive testing. For personal-data concerns, use the privacy process.