Trust & Safety
Security
Security is at the core of everything we build. Here's how we protect your data and our infrastructure.
Infrastructure Security
- All services hosted on Railway with automated deployments and isolated containers.
- TLS 1.3 enforced on all endpoints — no unencrypted traffic accepted.
- Database connections encrypted in transit and at rest.
- Environment variables and secrets managed through secure vault, never committed to code.
Authentication & Access
- Passwords hashed with bcrypt (cost factor 12) — never stored in plaintext.
- JWT-based authentication with short-lived tokens and secure httpOnly cookies.
- License keys generated using cryptographically secure random generators (128-bit entropy).
- Email verification required for all new accounts.
- Rate limiting on authentication endpoints to prevent brute-force attacks.
Data Protection
What leaves your machine depends on your plan. On Free, nothing does. On Local Pro, scans still run locally via npx and your source never leaves — but by default finding metadata (file path, line, severity, CWE) is synced to your dashboard; turn it off with --no-report. On the hosted plans, file contents are sent over TLS to api.safeweave.dev only for the scan, then the checkout is deleted; we retain findings, never your source.
| Plan | Source leaves your machine? | Where it's processed | Retention | External model calls |
|---|---|---|---|---|
| Free | No | Your machine | None (opt-in summary counts only) | No |
| Local Pro | No | Your machine | Finding metadata (path, line, severity, CWE) synced by default; disable with --no-report. No source. | No |
| Builder | Yes (hosted scan) | api.safeweave.dev over TLS | Checkout deleted after scan; findings retained | No |
| Builder Plus | Yes (hosted scan) | api.safeweave.dev over TLS | Checkout deleted after scan; findings retained | No |
| Agency | Yes (hosted scan) | api.safeweave.dev over TLS | Checkout deleted after scan; findings retained | No |
- We never access, read, or store your source code — only the findings a scan produces.
- Full data deletion available upon account termination.
Scanner Security
- All 8 scanners are built on trusted open-source engines (Opengrep, Trivy, Gitleaks, Nuclei, and more).
- Hosted scans run in sandboxed, ephemeral execution environments; the cloned checkout is deleted once the scan completes.
- Scanner versions are pinned and updated on a regular release cycle after security review.
- MCP server validates license keys and enforces plan-level feature gating on every request.
Payment Security
- All payments processed by Stripe — a PCI DSS Level 1 certified payment processor.
- We never see, store, or process credit card numbers or bank details.
- Webhook signatures verified on every Stripe event to prevent tampering.
Vulnerability Reporting
Found a security vulnerability in SafeWeave? We appreciate responsible disclosure. Please email support@safeweave.dev with details and we will respond within 48 hours. Do not publicly disclose vulnerabilities before we have had a chance to address them.