Security

Every workspace that executes code does so inside an isolated container with restricted capabilities, a read-only base layer, and resource caps (CPU, memory, disk, wall time). User code cannot reach the host filesystem, the api process, or other tenants. Outbound network is limited; inbound is allowed only through the ws and run channels Typelets controls.

Passwords are hashed server-side with argon2id at conservative cost parameters and never logged or returned in any API response. Session tokens live in httpOnly, Secure, SameSite=Lax cookies, signed with a server-side secret. CSRF protection is enforced on every state-changing endpoint.

Two-factor authentication via TOTP (Google Authenticator, 1Password, Authy, etc.) is available on every account. TOTP secrets are encrypted at rest with AES-256-GCM using a key stored separately from the database. Recovery codes are single-use and hashed before storage.

Every workspace, file, whiteboard, and Org operation runs a per-request authorization check against your membership and role. Public workspaces (shareScope='public') are explicitly opt-in by the owner; non-members of private workspaces receive 404 (we do not disclose the existence of resources you cannot access).

Traffic between your browser and Typelets is served over HTTPS / WSS at the edge (Cloudflare). Connections between our internal services use Fly.io's private 6PN network.

Workspace snapshots up to 256 KB are stored inline in PostgreSQL; larger ones are stored as objects in S3-compatible storage. Both layers use storage-at-rest encryption provided by the underlying infrastructure. Org icons are served with cache-friendly headers but no direct presigned URLs leak out.

Workspace data and snapshots are backed up regularly. Backups are encrypted and roll off within 60 days; account deletion timelines are described in the Privacy policy.

We rely on a small set of infrastructure providers (listed in the Privacy policy) that process data on our behalf. We review their security posture before depending on them and limit what each one can access to what the service needs.

We track dependency advisories on our package manifests and apply security upgrades promptly. Our CI runs typecheck and tests on every push to main and on every PR.

We keep request and audit logs and watch for abuse and anomalies. If we discover a security incident affecting your data, we will investigate, contain it, and notify affected users without undue delay.

Access to production systems and customer data is limited to the people who need it to operate Typelets, reached over authenticated channels, and logged.

We do not yet hold formal certifications such as SOC 2. We follow the practices on this page and will pursue certification as the product and customer base grow. If you have a specific compliance question, email [email protected].

If you find a security issue, please email [email protected] (or [email protected] if security@ bounces). Provide enough detail to reproduce. We will acknowledge within 72 hours and keep you informed while we investigate. We do not currently run a paid bug bounty, but we will credit reporters by name in our changelog with their permission.

Please do not run automated scans against production, attempt to access other users' data, or hold a finding for ransom. Acting in good faith and giving us reasonable time to respond will keep things friendly.