Security
This page lists only controls that exist in the product today. Each one names the test in our repository that checks it. We do not claim certifications we do not hold.
| Control | What it does | Checked by |
|---|---|---|
| Encrypted tokens | Google tokens are sealed with data keys that are wrapped by a master key kept outside the database, so a database dump alone does not expose them. | packages/config/src/crypto/keywrap.test.ts |
| Tenant isolation | Row-level security is enforced on every table that holds customer data, and a coverage test fails if a new table lacks it. | packages/db/src/__tests__/rls-coverage.int.test.ts |
| Crawler egress control | The crawler cannot reach private or metadata addresses: egress ranges are blocked and every resolved address is checked. | apps/crawler/src/guard/egress-ranges.test.ts |
| Safe outbound requests | Outbound fetches reject private answers and re-check the address after connecting. | apps/worker/src/net/safe-fetch.test.ts |
| Signed report links | Shared reports use high-entropy signed links with expiry and view limits, and every failure looks the same to the requester. | packages/config/src/security/signed-links.test.ts |
| CSRF protection | State-changing internal routes require a double-submit token. | apps/web/src/server/auth/__tests__/csrf.test.ts |
| Hardened containers | Containers run as a non-root user with a read-only root file system and dropped capabilities, checked by lint tests on the Dockerfiles and compose files. | scripts/security/compose-lint.test.ts |
| Append-only audit log | Sensitive actions are written to a hash-chained, append-only audit log. | packages/db/src/audit.int.test.ts |
| Dependency support window | A CI check blocks dependencies that are past their support window. | scripts/ci/eol-check.test.ts |
Data location and privacy defaults
Every customer gets the same privacy defaults that the GDPR requires, wherever they are located. See the privacy policy and the list of subprocessors for where data is stored.
Reporting a vulnerability
The disclosure mailbox has not been published yet. It will appear here and in security.txt before launch.