Security

Safeguards found in code

• Passwords are salted and hashed using PBKDF2-SHA-256. Session and recorder-token hashes are stored server-side.
• The sign-in cookie is HttpOnly, SameSite=Lax and Secure in production, with a 30-day lifetime.
• App requests check account/workspace membership; new guides start as drafts and public reads require publication.
• The app asset route checks workspace membership for draft images. Published images and logos are public. The database migration enables row-level restrictions for browser database roles.
• Screenshot masking and text leak checks offer partial risk reduction. They do not guarantee that a recording is safe.

The hosted services are accessed over HTTPS. Database TLS certificate verification is disabled in the inspected connection setup; this needs fixing and validation before stronger transport-security claims. Bucket/public-CDN configuration can bypass app asset checks and has not been verified here.

What has not been established

We have not established an independent penetration test, external certification, a formal audit programme, guaranteed recovery times, a verified backup/restore drill, complete deletion from backups or a staffed incident response service. Encryption-at-rest configuration and administrative access controls need confirmation from the actual provider accounts. Do not treat this page as evidence that those protections have been audited.

Use test data, protect connection tokens and review guides before publishing. Public guide screenshots can remain in caches and downloads after unpublishing. The early service is not offered for regulated or highly sensitive records.

Report a problem

Email hello@asterly.co with “Security incident” or “Security report”. Include affected URLs, times and safe reproduction steps; avoid personal records, credentials or destructive testing. The mailbox must be confirmed by Yash. We do not promise a fixed response time or a bounty. Report suspected exposed data promptly; see Data deletion & contact.