# Security

What is true of Surf Studio security today, and how to report a problem.

## This site

- Its pages run no analytics and load no script from another address.
- It sets no cookie until you sign in. Signing in sets the cookies that keep you signed in.

## How Studio changes

- Every change to Studio lands through one merge path, after its checks pass on that exact commit.

## Reporting a problem

Follow [Report a vulnerability](https://studio-previews-phi.vercel.app/security/disclosure). It says how to report, what to expect and what is in scope.

## The legal texts

The Terms, the Acceptable Use Policy, the Data Processing Addendum, the Privacy Policy and the Sub-processor List are in force. The [legal page](https://studio-previews-phi.vercel.app/legal) lists them, and the drafts that are not.

Canonical page: https://studio-previews-phi.vercel.app/security