Security
StepShown collects as little as it can.
StepShown has no user accounts, sign in, public connection for other apps, database of your calculator numbers, or file uploads. Having less data to protect lowers risk.
Last updated
Current controls
- Inputs have safe smallest and largest allowed values.
- User entries cannot become website code.
- Other sites cannot place a full StepShown page inside their page.
- Special browser rules limit what each page can load and do.
- Automated checks cover code, browsers, and accessibility.
- Website statistics remove calculator numbers before sending data.
Known boundaries
A shared link or embed code can contain your calculator numbers. Before copying, you can remove one field, remove one list row, or make a clean link with every number removed. A copied result summary may still reveal an answer based on numbers you removed from its link, so StepShown warns you. The company that hosts StepShown can also process the full page address in normal request and security logs. Never treat a scenario link as private storage.
StepShown Journey keeps its plan in the current browser instead of a StepShown database. It does not put the amounts in the page address. Anyone who can use the same browser profile may still be able to open the plan. Remove the plan or clear the website data before sharing a device or browser profile.
Responsible reporting
If you find a security weakness, do not view another person’s data, disrupt the site, or publish instructions that could cause harm. Use the contact route and provide the smallest safe set of steps that shows the problem.