Security and responsible reporting
What this website protects
Rob’s AI Tools combines local browser utilities with a private hosted admin and first-party website statistics. Public visitors do not need to sign in. Browser tool inputs stay in the browser; the website still processes connection information and the analytics measurements explained in the Privacy notice.
Private admin records require server-side authentication. Password hashing, secure session cookies, session expiry, origin/request checks, rate limits and conflicting-edit protection reduce risk. The app currently has no second authentication factor of its own. Use a unique password, protect the recovery key and secure the hosting and email accounts separately. Private notes are not public website content, but access control is not a promise of end-to-end encryption.
Backups and safe changes
Review content before publishing. Keep a current content export before substantial changes. Website version history helps recover earlier content, but is not a full operational backup of accounts, secrets, email or all private records. Automated full recovery has not been established by this release. A source update can affect saved page edits; reconcile those edits before deploying structural changes.
Downloads and local software
Use only the download linked from the verified release page and check its release status. A matching checksum confirms matching bytes; it is not proof of trust, absence of malware or Apple notarisation. The public Mac installers remain unavailable while their stated release checks are outstanding. Do not disable operating-system protections to install a preview.
QuotaPerch’s approved helper and M4A DJ Studio’s local processing have separate boundaries described on their product pages. The website’s checks do not certify the safety of every device, third-party executable, recording or future build. Local files and exports may be visible to other software or people with access to your device.
Report a suspected vulnerability privately
Email robin@robsaitools.com with “Security concern — Rob’s AI Tools” in the subject. Include the affected page or tool/version, approximate discovery time, expected and observed behaviour, minimal safe reproduction steps and redacted evidence. Do not include passwords, recovery keys, access tokens, complete mailbox exports or other people’s records. For sensitive evidence, first request an appropriate secure sharing method.
If you accidentally encounter another person’s information, stop immediately. Do not copy, change, download or use it; describe the location and circumstances without transmitting the information itself. Do not disrupt service, conduct high-volume testing, attempt social engineering, persist access or use stolen credentials.
This reporting invitation does not authorise intrusive testing, waive third-party rights or establish a bounty programme. Ask for written permission before testing beyond ordinary authorised use. There is no guaranteed response time or payment. We welcome proportionate private reporting and will assess reports in good faith. Please avoid public disclosure of sensitive details while a fix is being assessed.
If your account may be compromised
Use a trusted device to change the affected website password or use the private recovery route. Protect the associated hosting and email accounts too. Review recent website versions and account activity; a website password change invalidates older website sessions. Report unexpected changes and preserve redacted evidence. Do not post your recovery key or credentials in a support ticket.
What verification means
Automated checks and preview tests reduce risk; they do not constitute an independent penetration test or a certification that a service cannot be compromised. Release statements should identify what was actually tested and what remains unverified. The Privacy notice explains data handling, and the Terms explain use and statutory rights.