Security & Data Handling

Last updated: August 28, 2026.

What you upload

ShipForge is designed to analyze a ZIP archive of your app's source files: uploaded over HTTPS to a private, access-controlled backend (Supabase Storage), never made public, never listed in search engines, never shared. The customer upload path is not live yet — during Founding Beta you submit your project through a reviewer, not a self-serve upload. Public share pages render only a score snapshot you explicitly consent to publish — never your code, file names, findings, or identity.

What we send to AI providers

When an automated analysis runs, ShipForge sends only non-secret metadata to the configured AI model provider — repository name, scores, and finding summaries — not your source file contents, and never your credentials, environment variables, or secrets. We strip obvious secret-looking strings where detected, but you are responsible for not uploading real production secrets. Do not upload .env files, API keys, or service account credentials. Use a sanitized build of your app. (File-content analysis is a planned capability; it is not live today.)

Credentials & secrets

Provider secrets (AI API keys, Lemon Squeezy, Supabase service role) live only in server-side environment variables on Vercel — never in source code, never in the browser, never in localStorage. The Supabase service role key is used server-side only to read/write your delivery records and storage objects; it is never returned to the browser. GitHub connections are designed to use OAuth installation tokens with least-privilege scopes — but the GitHub App is not registered yet, so GitHub connections are not live. We do not store per-customer OAuth tokens today.

Authentication

Customer authentication uses Supabase magic-link email login. There are no passwords to compromise. Email delivery for magic links is not yet verified (Supabase SMTP); Google sign-in is disabled until enabled and proven end-to-end. Session tokens are validated server-side on every API request; every workspace query is scoped to your authenticated owner id, so changing a project or scan id in a URL cannot expose another customer's data. Automatic session refresh is a planned capability, not yet implemented.

Payment security

Payments are processed by Lemon Squeezy. Card data is handled entirely by Lemon Squeezy's PCI-compliant checkout — ShipForge never sees or stores your card number. Webhook events are verified with a HMAC signature before any entitlement is granted, so a forged request cannot grant paid access.

Retention

Uploaded source archives are intended to be retained only while your project is active and for a limited window to allow rescans, then deleted. Automated deletion is not yet implemented — during Founding Beta, data is removed manually on request. You may request deletion of your project and associated data at any time by emailing hello@shipforgeai.dev.

Reporting a vulnerability

If you believe you have found a security issue, please email hello@shipforgeai.dev with details. We ask for responsible disclosure and will acknowledge within 2 business days.