Security

What we actually do — and what we don't claim.

What we do

• Project-scoped API keys (X-API-Key header or query param); project provisioning behind an admin token in production. Paid projects are provisioned by Stripe's signature-verified webhook and credentials are delivered through a one-time claim (only the hash of the checkout session is stored, and the stored key is wiped when claimed); on the hosted instance, operator provisioning refuses outright when no admin token is configured. Ingest can also use a per-project DSN public key (Sentry-compatible): it can only submit events — it cannot read issues, view payloads, or change settings. Slack alert links never carry a credential.
• Event payloads capped (413 beyond BUGFLAT_MAX_EVENT_BYTES); stored samples truncated.
• Cross-project access returns 404 — issues are strictly namespaced per API key.
• We are not SOC 2 certified. SQLite in v1 (fine to ~10M events/mo); Postgres is the documented scale path.

What we don't claim

We are not SOC 2 certified, not ISO 27001 certified, and we don't use the phrase "military-grade encryption". If we name a cipher, we name the key management next to it. Security claims on this page describe the software as shipped — verified in the product repo, not in a badge.

Report an issue

Found a vulnerability? Email don+bugflat@lifeofmorr.com with details. We respond to good-faith reports promptly and don't pursue researchers who follow responsible disclosure.