Security

Security at QAFind

Authentication and secrets

Passwords are hashed with Argon2id. Session cookies are HttpOnly, SameSite and Secure in production. API keys are stored as hashes and shown once. Model, Stripe and GitHub private keys stay server-side. Hosted runs receive phantom credentials, never production secrets.

Isolation

Hosted browser workers run in a separate container and network namespace with egress rules checked on deploy. The browser runs without access to the host or private network by default. Evidence bundles are signed with Ed25519 and can be verified offline.

GitHub integration

Webhooks are verified with HMAC signatures. GitHub App installation tokens are short-lived. Commands are accepted only from repository owners, members and collaborators. Installation claims require a one-time state bound to the signed-in console.

Payments

Card data is processed by Stripe. We store Stripe customer/subscription identifiers and plan status, not card numbers. Stripe webhooks are signature-verified and deduplicated.

Backups

The database is backed up with VACUUM INTO snapshots, verified for integrity, rotated, and optionally copied off-site with encryption configured on the storage remote.

Disclosure

Report a vulnerability to security@qafind.si with steps to reproduce. Please do not access other customers’ data or run destructive tests. We will acknowledge and investigate.