Is my card page secure?

Answered by the team

Every address is served over HTTPS with its own certificate, links a visitor types are upgraded to HTTPS or refused, nothing anybody types into a card is ever treated as code, and uploads are checked by their real bytes rather than their file name. Your dashboard is behind a sign-in that pins each screen to your own account, so a link to somebody else's screen returns nothing.