Security

Last updated October 15, 2026

Pub holds two things worth protecting: what writers publish, and the email addresses of the people who read it. Here's what happens to both.

Signing in

There are no passwords. Writers sign in with a one-time link or code sent to their email. The link works once, for 15 minutes, and the code stops working after 5 wrong tries.
Only hashes of sign-in links and session tokens are stored, so a copy of the database can't be used to sign in.
Readers don't have accounts. The links in their emails (confirm, unsubscribe, manage, read online) carry a signed token that names only their subscription and what the link may do. The signing key lives only in the application's environment.

Newsletters are sent through Amazon SES from an address on mail.usepub.com, signed with DKIM, with SPF and DMARC set on the domain.
A free sign-up is confirmed by email before anything else is sent to that address. Paying for a subscription counts as confirmation.
Every newsletter carries a one-click unsubscribe header and an unsubscribe link in its footer. Unsubscribing takes effect at once.
Addresses that bounce or report a message as spam are never emailed again by any publication on Pub.
Pub doesn't put tracking pixels or tracked links in email, and doesn't record opens or clicks.
Lists a writer pastes in are capped, so a bought list can't be run through Pub.

Posts are written in Markdown. Anything typed as raw HTML is shown as text, not run, and links and images have to be plain web or mailto addresses. So a post can't carry script onto a reader's page.
Images in posts load from wherever the writer hosts them. Pub doesn't proxy them.

Paid subscriptions run on the writer's own Stripe account, connected to Pub through Stripe Connect. Readers pay on Stripe's checkout page; card numbers never touch Pub.
Pub keeps a 5% application fee on each payment. It sees subscription status and the reader's email, nothing more.
Stripe's webhooks are checked against their signature, and a subscription's state is always re-read from Stripe before it's recorded.

Everything runs on Amazon Web Services in the US (Ohio, us-east-2): Lambda, Aurora DSQL, SES and CloudFront.
Data is encrypted at rest and in transit. The site is HTTPS only, with HSTS. The application can only be reached through the CDN.
Deleting a publication deletes its posts, its subscribers and its delivery records.

Email security@usepub.com. We read everything and answer what needs answering.