Security

This page describes controls implemented in the current product. It is not a certification claim or a substitute for your own vendor review.

Remote-spec fetch protection

• Only HTTP and HTTPS URLs on ports 80 and 443 are accepted.
• Loopback, private, link-local, local/internal hostnames, and IPv4-mapped IPv6 private addresses are rejected.
• The validated DNS result is pinned for the connection, closing the resolve-to-connect DNS-rebinding window.
• Redirects are not followed; users must provide the final URL directly.
• Responses have a 10-second timeout and a 5 MB post-decompression limit.
• Remote $ref URLs are not fetched. Only local in-document references are resolved.

Accounts and sessions

Passwords are stored with PHP's password hashing API. Login creates a random server-side session whose token is stored only as a SHA-256 hash in the database. Production session cookies are Secure, HttpOnly and SameSite=Lax; state-changing requests also require a matching CSRF cookie/header pair. Sessions have a 30-day absolute lifetime, a 14-day idle lifetime, rotation on login, and server-side revocation.

Stored API data

API Guard stores the registered URL plus a parsed, normalized specification and its hash, not the original raw text. Change history contains the classified differences. Deleting a watched API removes its stored specification and history; deleting an account removes sessions and watched APIs.

Outbound webhook protection

Pro notification destination URLs and generic-webhook signing secrets are encrypted at rest with authenticated secretbox encryption. Outbound URLs must use public HTTPS on port 443, pass the same private-address and DNS-pinning controls used by spec fetches, and cannot redirect. Generic payloads exclude the specification URL, account email, user ID, and raw specification. They are signed over the exact JSON bytes with HMAC-SHA256 in X-Cryonel-Signature; the signing secret is shown only once when a destination is created.

Billing and operational controls

Polar hosts checkout and keeps card data. Incoming billing events use Standard Webhooks HMAC verification, a five-minute timestamp tolerance and idempotent event records. Sensitive account actions and authentication routes are rate limited. Application logs are retained for 30 days and security/authentication logs for 90 days; neither is intended to contain specification content or tokens.

Scope and reporting

No SOC 2, ISO 27001, penetration-test or SLA claim is made here. For a data-flow inventory see Technical Transparency; privacy and retention terms are in the Privacy Policy. Security reports can be sent through the Contact page.