Security at Stack Cost AI.

Our security model.

Stack Cost AI is a static website: pre-built files served by a hosting provider. There is no login system, no server-side application processing your input, and no database holding user records.

That's not laziness — it's the point. The most common breach patterns in web software (stolen credential databases, injection attacks against user tables, session hijacking) have nothing to act on here. The best way to protect a treasure chest is to not have one.

Where your data lives.

Every estimate you build is computed inside your browser, and your provider selections are stored only in that browser's local storage. They never travel to our servers — there is no code path that could send them even if we wanted them to.

• The site itself is served over HTTPS.
• Private/incognito windows don't persist your selections at all.
• "Clear all" on the My Summary page wipes your saved selections on the spot.

Our third-party surface.

Every third-party script a site loads — analytics, ads, chat widgets, session replay — is another supply-chain risk. So we load none of them. Our entire external footprint is:

• A static hosting provider serving the built site over HTTPS.
• Google Fonts, for the Inter and JetBrains Mono typefaces.

There are also no secrets to leak: a static site has no API keys, tokens or credentials embedded in it, because it doesn't need any to run.

Report a vulnerability.

Found something? We'd genuinely like to hear about it. Emailhello@stackcostai.com with as much detail as you can — what you found, how you found it, and how to reproduce it.

A few requests in return:

• Give us reasonable time to investigate and fix before disclosing publicly.
• Don't run denial-of-service or spam tests against the site.
• Don't degrade the experience for other visitors while researching.

On our side of the deal: we'll acknowledge your report, investigate properly, fix genuine issues promptly, and credit you publicly if you'd like. There's no paid bug bounty program today — we'd rather tell you that straight than dress up a "thanks" as a reward.

Ongoing practices.

Small attack surface isn't an excuse for complacency. What we keep doing:

• Keeping dependencies updated and rebuilding from source regularly.
• Reviewing before any new external resource is added — the default answer is no.
• Collecting less data than most sites, which remains the cheapest security control there is.