Security

Last updated 2 November 2026.

How we protect your account

  • No portal passwords. You sign in only through GitHub, Google or Apple, so we never store a password for the portal.
  • Encrypted in transit. The site is served over HTTPS, and our session and form-protection cookies are sent only over HTTPS.
  • Minimal data. We keep the email address and display name from your provider, and nothing else from your provider profile. See our Privacy Policy.

How we protect your API keys

  • Your full key is shown once, when you create it. We do not store it.
  • We store only a one-way hash of each key, plus a short prefix so you can recognise it in the console.
  • You can revoke a key at any time from the console. Revoked keys stop working within about 30 seconds.

How we protect your payments

Payments are handled by Stripe, through Stripe Checkout and the Stripe Customer Portal. Card details go straight to Stripe, and our servers never receive or store them. Stripe signs every webhook it sends us, and we reject any that fail verification.

How we run the service

Our servers and database run on separate hosts, behind a load balancer, on infrastructure we manage. Secrets, such as database passwords and provider keys, are kept in an encrypted vault and are not stored in our source code.

Report a vulnerability

If you believe you have found a security problem, please tell us privately first. Email [email protected] with “Security report” in the subject line.

Please include what you found, the steps to reproduce it, and the impact as you understand it.

To keep everyone safe, please:

  • test only accounts and keys that you own;
  • do not access, change or delete other people's data;
  • do not run tests that degrade the service for others, including denial-of-service testing;
  • give us a reasonable time to fix the problem before you disclose it publicly.

We will acknowledge your report, keep you informed, and credit you if you wish. We do not currently run a paid bug bounty.

Problems with your account

If you think someone has used your account, revoke your API keys from the console and write to [email protected].