How we protect your data

• All traffic is served over HTTPS; the app sends HSTS and a strict content policy.
• Every stored table enforces row-level access rules — a signed-in user can only read and write their own runs. Reports are private until you explicitly publish them.
• CI API keys are stored only as SHA-256 hashes. The plaintext key is shown once at creation and can never be recovered — only revoked and replaced.
• Rate-limit and abuse records store a salted hash of the IP address, never the raw address.
• Payments never touch our servers. Card details are handled entirely by Paddle as Merchant of Record; webhook events are verified by signature before we act on them.
• The URL audit refuses private, loopback, link-local and cloud-metadata addresses, caps redirects and response size, and applies a request timeout.
• Benchmarks execute locally in your browser. Nothing is uploaded unless you are signed in or you opt in to the anonymous device ranking.

We are not currently SOC 2, ISO 27001, HIPAA or PCI certified, and we do not claim end-to-end encryption. If you need a formal assurance package for procurement, contact us and we will tell you honestly what we can and cannot provide today.

Use the security incident report form — it routes straight to our triage queue, lets you attach logs and gives you a tracking reference. You can also email security@redline.app with steps to reproduce, affected URLs and any proof-of-concept. We aim to acknowledge within two business days and to give a remediation plan within ten.

Please test only against your own account, avoid accessing other users' data, do not run denial-of-service or spam tests, and give us reasonable time to fix an issue before disclosing it. We will not pursue legal action against researchers who follow this. A machine-readable version of this contact is published at /.well-known/security.txt.

Use a strong, unique password, revoke CI keys you no longer need, and only audit URLs you are authorised to test. See the terms for the full acceptable-use rules.