Security
Your flags, errors, logs and secrets are sensitive. Here's how we protect them.
- Encryption
- TLS everywhere with HSTS. Secrets, credentials, contact details and capability tokens are encrypted at rest with AES-256-GCM, and the master key rotates without downtime.
- Accounts
- Passkeys, TOTP, breached-password checks, rate-limited sign-in, and optional organization-wide 2FA, SSO (SAML/OIDC), SCIM, session limits and IP allowlists.
- Isolation
- Every request is authorized against the organization and project it touches, and API clients get scoped, short-lived tokens.
- Auditing
- Security-relevant changes are recorded with actor, IP and user agent, and can be exported or streamed to your SIEM.
Reporting a vulnerability
Email the address in our security.txt with steps to reproduce. Please don't open a public issue, access other people's data, or degrade the service while testing.
We acknowledge reports within 3 business days, keep you updated while we fix them, and credit you if you'd like. We won't pursue legal action for good-faith research that follows these guidelines.