What we learn from attacking our own systems, written down for everyone.
RED is the public notebook of Hookay's security and privacy engineering work. We publish research findings, hard-won best practices, and blameless post-mortems — because privacy engineering for queer platforms is too important to keep proprietary. Everything here is generalized: lessons, not blueprints.
// New here? Start with “Why k-anonymity is a floor, not a feature”
De-anonymizing the “anonymous”: how location aggregates leak identity, and how to design ones that don't
Aggregated location stats feel safe — “31 people in this area this week” names nobody. Our internal red-teaming shows how cell size, update cadence, and cross-time correlation can still single out individuals, especially in low-density regions. We walk through the attack classes, then derive concrete design rules: minimum cohort thresholds, net-delta updates, and why suppression must fail closed.
Read the full article →Recent publications
Why we publish
Hookay protects data that, in the wrong hands, can endanger lives. We hold ourselves to standards we're willing to defend in public — and we'd rather the whole ecosystem get better than keep an edge.
Lessons, not blueprints
We publish generalized findings and patterns. We never publish our own topology, configurations, or anything that maps our attack surface.
Blameless and complete
Post-mortems name failures, timelines, and fixes — never individuals. If we can't tell the whole story safely, we wait until we can.
Users before reputation
If a finding affects our users, they hear it from us first, plainly. RED is the long-form follow-up, not the announcement channel.
Free to reuse
All articles are published under CC BY 4.0. Take the patterns, cite the source, build safer queer spaces.
Responsible disclosure
If you've found a vulnerability in a Hookay system, we want to hear from you — confidentially, encrypted, and with a guaranteed response within 24 hours. Good-faith research is protected under our safe-harbor policy. The full policy, scope, and reward guidelines live on our disclosure page.
security@hookay.eu · PGP key · /.well-known/security.txt · Disclosure policy →