Trust
Security, documented.
The controls we run, in writing, so you can verify instead of trust.
Hashed identifiers
Visitor IPs are SHA-256 hashed in transit at the API layer. Raw addresses never touch a disk.
Row-Level Security
Every Postgres table ships with RLS policies. Projects and plans are invisible across accounts by database law, not app hope.
Short-lived tokens
Verification JWTs expire in 5 minutes and are signed per-project. Replay windows are tiny by design.
Origin pinning
Public keys can be locked to your domains, so a leaked key dies outside your origin.
Live rate limiting
Signups, logins, resets, and API calls are throttled per IP, email, and key. Thresholds are admin-editable in real time.
Gated admin console
Admin endpoints verify your session server-side against an admins table. The service-role key never leaves the server.
Fail-open design
If detection is unreachable, real users are never locked out. We would rather miss a bot than lose a customer.
Responsible disclosure
Found a hole? Email info.bravehx@gmail.com with subject SECURITY. We acknowledge within 48 hours, coordinate a fix window, and credit verified reporters on this page.
Out of scope: social engineering, physical attacks, and issues in third-party services we do not control.