Security
Effective June 26, 2026 · Last updated June 26, 2026
Reporting a vulnerability
If you discover a security vulnerability in cloneside — the hosted service, the API, or the open-source CLI — please disclose it responsibly before sharing it publicly.
Email: security@cloneside.com
PGP key: available on request (reply to your initial report email).
We commit to:
- Acknowledging your report within 48 hours
- Providing a remediation timeline within 7 days
- Notifying you when the issue is resolved
- Crediting you in the changelog if you wish (opt-in)
We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to remediate it (typically 90 days).
Scope
| Target | In scope |
|---|---|
| cloneside-api-production.up.railway.app (REST API) | Yes |
| app.cloneside.com (dashboard) | Yes |
| cloneside.com (landing page) | Yes |
| PyPI package cloneside (CLI) | Yes |
| GitHub Actions / CI pipeline | Yes |
| Third-party infrastructure (Railway, Vercel) | No — report to them directly |
| Customer databases connected via cloneside | No — customer-controlled |
Security controls
| Control | Implementation |
|---|---|
| Passwords | bcrypt, cost factor 12 — never stored in plaintext |
| Database connection strings | AES-256 (Fernet) encrypted at rest; plaintext in memory only during job execution |
| Authentication tokens | Short-lived JWTs signed with SECRET_KEY; stored as httpOnly cookies |
| Transport security | TLS 1.3 enforced by Railway and Vercel on all endpoints |
| Credential sanitization | DSN passwords stripped from all error messages and logs (regex-enforced) |
| Audit logging | Append-only audit_logs table; all auth and data operations recorded |
| Dependency updates | Dependabot weekly scans on both repos |
| Secret management | All secrets in Railway / Vercel environment variables — never in source code |
What we do not store
- No rows of data from your source databases — only schema metadata and statistics
- No plaintext passwords or plaintext connection strings persistently
- No third-party tracking cookies or analytics that process personal data
Incident response
In the event of a confirmed security incident affecting customer data, we will:
- Contain the incident within 4 hours of confirmation
- Notify affected users within 72 hours (GDPR Art. 33 / LGPD Art. 48)
- Post a status update at our status page
- Publish a post-mortem within 5 business days
Bug bounty
We do not currently operate a formal paid bug bounty programme. However, we genuinely appreciate responsible disclosures and will acknowledge contributors publicly (with permission) and provide cloneside Pro access for significant findings.
Contact
Security disclosures: security@cloneside.com
Privacy: privacy@cloneside.com
General: hlsbritto@gmail.com