Security

How we keep SlugBase safe.

This page describes how SlugBase is designed and how to tell us about a vulnerability.

How it is designed

  • SlugBase Cloud is hosted in the European Union.
  • Sign-in sessions are kept on the server. Your browser holds only a session cookie that scripts cannot read, and the server stores a hash of the session token, not the token itself.
  • Secrets that SlugBase stores, such as two-factor secrets, are encrypted before they are written to the database.
  • Traffic between your browser and SlugBase is encrypted with TLS.

These are design statements about how SlugBase works. They are not a certification, and SlugBase has not been through a certification or an independent audit.

Report a vulnerability

If you find a vulnerability in SlugBase, please tell us through one of these two routes.

Please do not report vulnerabilities in public issues, so that we can fix them before they are public.