Security & Trust
Autoflowly is designed with security at every layer — authentication, encryption, per-app isolation, and rate limiting. This page covers what matters for evaluating the platform, without publishing an internal implementation blueprint.
Authentication
- Token-based sessions with short-lived access tokens and longer-lived refresh tokens
- Passwords are hashed with an industry-standard algorithm and never stored in plaintext
- OAuth sign-in available via Google and GitHub — no new password required
| Provider | Protocol | What's Verified |
|---|---|---|
| OAuth 2.0 | Email, profile, email verification status | |
| GitHub | OAuth 2.0 | GitHub identity, email |
| Password | Hashed, never stored in plaintext |
All OAuth flows use server-side token exchange — client secrets never reach the browser.
Encryption
- In transit: TLS enforced on all endpoints; HTTP always redirects to HTTPS
- At rest: sensitive fields (credentials, tokens, secrets) are encrypted; database credentials, API keys, and user secrets are stored as platform secrets, never in source code
App Isolation
Every app you build runs in its own isolated environment:
| Layer | Isolation Mechanism |
|---|---|
| Compute | A dedicated pod per app — no shared processes with other users' apps |
| Network | Default-deny network policy; only explicitly allowed traffic reaches each app |
| Storage | Each app has its own files and database — no shared filesystem |
| URL | A unique preview URL per app |
| Lifecycle | Apps can be deleted independently without affecting anyone else's |
Rate Limiting
Requests are rate-limited by identity (anonymous, authenticated, premium), with tighter limits on sensitive routes like login and generation. Rate-limit status is returned in response headers.
Security Headers & Input Validation
All responses include standard defensive headers (HSTS, clickjacking/MIME-sniffing protection, a restrictive Content-Security-Policy). All API input is schema-validated; database access goes through parameterized queries — no raw SQL string interpolation. Generated app code passes through automated build validation before it's ever deployed.
Data & Compliance
- GDPR-aware: every generated app ships with its own privacy policy and legal pages, and account/data deletion requests are honored (see Account Deletion)
- No secrets in source code — all credentials are injected as platform secrets, scoped per environment (dev/staging/production) and per service
Reporting Vulnerabilities
If you discover a security issue, please report it responsibly:
- Email: security@autoflowly.com
- Scope: Authentication, authorization, data exposure, injection, infrastructure
We take all reports seriously and aim to respond within 48 hours.