Infrastructure Security
- All services hosted on Railway with automated deployments and isolated containers.
- TLS 1.3 enforced on all endpoints — no unencrypted traffic accepted.
- Database connections encrypted in transit and at rest.
- Environment variables and secrets managed through secure vault, never committed to code.
Authentication & Access
- Passwords hashed with bcrypt (cost factor 12) — never stored in plaintext.
- JWT-based authentication with short-lived tokens and secure httpOnly cookies.
- License keys generated using cryptographically secure random generators (128-bit entropy).
- Email verification required for all new accounts.
- Rate limiting on authentication endpoints to prevent brute-force attacks.
Data Protection
What leaves your machine depends on your plan. On Free, your code doesn't: scans run locally via npx, and only severity counts are sent to your dashboard (no findings or file paths). On the hosted plans, file contents are sent over TLS to api.safeweave.dev for the scan, then the checkout is deleted; we keep the findings and a short excerpt of code around each one (never for a secret), not your repository.
| Plan | Source leaves your machine? | Where it's processed | Retention | External model calls |
|---|---|---|---|---|
| Free | No | Your machine | Severity counts only, no findings or file paths (turn off with SAFEWEAVE_NO_REPORT=1) | No |
| Cloud | Yes (hosted scan) | api.safeweave.dev over TLS | Checkout deleted after scan; findings and short code excerpts retained (never for secrets) | Only when you request an AI fix (Anthropic) |
| Cloud Plus | Yes (hosted scan) | api.safeweave.dev over TLS | Checkout deleted after scan; findings and short code excerpts retained (never for secrets) | Only when you request an AI fix (Anthropic) |
- We never store your repository. Cloud scans keep the findings and a short excerpt of code around each one, so you can see and fix it in context; no excerpt is ever kept for a secrets finding.
- Local scans send severity counts only — no findings, file paths or repository names.
- AI fixes are optional. When you ask for one, that finding and its excerpt are sent to Anthropic's API, which does not train on API data.
- Full data deletion available upon account termination.
Scanner Security
- All 8 scanners are built on trusted open-source engines (Opengrep, Trivy, Gitleaks, Nuclei, and more).
- Hosted scans run in sandboxed, ephemeral execution environments; the cloned checkout is deleted once the scan completes.
- Scanner versions are pinned and updated on a regular release cycle after security review.
- Live app checks on Cloud App URL scans are read-only: they use only the keys your app already ships publicly, never write, update or delete anything, and keep no data they read — findings name tables, buckets and files, never their contents.
- MCP server validates license keys and enforces plan-level feature gating on every request.
Payment Security
- All payments processed by Stripe — a PCI DSS Level 1 certified payment processor.
- We never see, store, or process credit card numbers or bank details.
- Webhook signatures verified on every Stripe event to prevent tampering.
Vulnerability Reporting
Found a security vulnerability in SafeWeave? We appreciate responsible disclosure. Please email support@safeweave.dev with details and we will respond within 48 hours. Do not publicly disclose vulnerabilities before we have had a chance to address them.