How submissions are handled, end to end.
Cookie-only sessions. Private-by-default retention. Browser security headers. Rate limits before detection runs. This page describes the controls currently in place.
What’s in place.
Production traffic is served over HTTPS through Cloudflare Workers.
Sessions in two HTTP-only, Secure, Lax cookies. No tokens in localStorage.
Referrer-Policy, X-Content-Type-Options, X-Frame-Options, and Permissions-Policy are emitted by the app.
Scans are saved privately to your account (RLS-scoped) and stay private unless you share. Ephemeral scans run without storing content.
Submission content and raw scores are not sent to product analytics; detection events use coarse, privacy-safe fields.
Scan endpoints enforce per-IP and per-account limits before credits are charged.
Team membership and invitation changes are recorded with actor, timestamp, and target organization.
Primary data lives in managed database and object storage services; account deletion removes account-scoped records and stored media where possible.
security@detecto.co. 90-day coordinated disclosure window unless active threat warrants faster public disclosure.
Auth model
Sessions live in two HTTP-only, Secure, SameSite=Lax cookies. No tokens in localStorage. Server components read session via the SSR client; client components receive a serializable user shape from the layout.
Auth providers: Google OAuth, X (Twitter) OAuth, magic-link email. Magic links are single-use and expire in 15 minutes.
Browser security headers
Marketing and app pages emit Referrer-Policy, X-Content-Type-Options, X-Frame-Options, and Permissions-Policy. A stricter Content Security Policy will be claimed here only after the production header ships.
Audit log
Team workspace membership changes write to an organization audit trail. Scans, credits, billing state, and auth events are stored with timestamps where those records are part of the product flow.
Incident response
Security reports route to the address below. Customer notice for data-impacting incidents goes to the email on file as required by applicable breach-notification rules.
Reporting a vulnerability
Email security@detecto.co with a description and reproduction steps. We acknowledge within two business days. Coordinated disclosure: 90 days from acknowledgment unless an active threat warrants faster public disclosure.