A safer home for local trust.
Pocket Universe has its own HTTPS address. Before asking anyone to register or save personal experiences, we’re making the security boundary visible: what is configured, what has been tested, and what is still missing.
No real sign-in is available yet.
This is a public development preview. Do not enter passwords, personal identifiers, confidential receipts or accusations about real people. Session tests use fictional identities on an isolated local HTTPS server, never the public site.
PROVEN VS. BLOCKED
What is ready to test?
Securing the connection is only the first layer. An encrypted web address does not, by itself, create a secure personal account system.
Implemented and verified
✓
Dedicated HTTPS domain
Domain routing, certificate, 301 redirect and an HTTPS-only browser origin.
✓
Certificate renewal route configured
Certbot timer, ACME challenge and edge sync present. Staging renewal test still pending.
✓
Local session-kernel tests
Opaque server tokens, expiration, logout and rotation exercised on loopback TLS.
✓
CSRF and owner checks
Same-origin request checks and fictional private-object authorization tests.
Not launched
×
Real account signup and login
No verified identity provider or public credential collection.
×
Stored private Case evidence
No encrypted production evidence vault, backup/retention or account recovery.
×
Live moderation and appeals
No trained reviewers, real complaint queue or business right-of-reply system.
×
Arrival alerts and public Signals
No automatic neighborhood accusation notifications or verified reports.
Identity must come from a trusted source—not a typed username.
A trusted identity provider authenticates the person over HTTPS.
The server issues an opaque Secure, HttpOnly, SameSite cookie.
Every private Case or Signal checks real ownership and Orbit scope.
Only a separately moderated, privacy-reviewed projection can become public.