Vrolen
Security
Updated 28 August 2026
Vrolen is in private pilot. We use practical controls appropriate to the current service and avoid claiming certifications we do not hold.
Website and waitlist
The marketing site is delivered through Cloudflare. Waitlist submissions are protected with Turnstile, strict validation, exact-origin checks, and a server-side Supabase function. The public client cannot read, update, or enumerate waitlist records.
Data and access
Waitlist data is stored in Supabase with row-level security. Administrative credentials remain server-side and are not included in the browser bundle. Error reporting is scrubbed to avoid sending form data.
Responsible disclosure
If you believe you have found a security issue, email [email protected] with a clear description and steps to reproduce. Please do not access other people’s data, disrupt the service, or publish an unresolved issue.