Security practices
The concrete controls that protect your account and your data. Each is mapped to our internal security system, which labels anything it cannot verify rather than assuming it is safe.
Identity & access
Least-privilege, allowlisted admin access
In placeInternal tools are restricted to an explicit operator allowlist with role-based permissions, so a single account cannot change everything.
Data protection
Secrets never reach the browser
In placeAPI keys and service credentials live only in server environments and are never included in pages delivered to your browser.
Database row-level isolation
In placeWhen cloud accounts are enabled, row-level security ensures you can only read and write your own data — enforced at the database, not just in the app.
On-device video analysis by default
In placeSwing videos are analyzed in your browser. Footage is not transmitted to external servers by default, and is never used to train AI models without your explicit consent.
Application security
HTTPS everywhere with hardened security headers
In placeEvery page is served over HTTPS with a Content-Security-Policy, X-Frame-Options, and HTTP Strict-Transport-Security to defend against injection, clickjacking, and protocol downgrade.
Validated, bounded uploads
In placeUploads are restricted to known media types with enforced size and duration limits, reducing the risk of malformed or abusive files.
User-generated content is sanitized
In placeAnything you type that is shown back in the interface is sanitized before it is rendered.
AI safety
AI abuse & spend safeguards
In placeAI endpoints sit behind rate limiting and a global daily spend cap, so abuse cannot degrade service or produce a runaway bill.
Monitoring & incident response
Admin audit logging
In placeSensitive internal actions are recorded so changes are accountable and incidents can be reconstructed.
Written incident-response runbook
In placeWe maintain a runbook covering secret exposure, account compromise, and data-leak scenarios so response is a checklist, not a scramble.
Secure development
Automated security scanning in CI
On roadmapWe are rolling out secret scanning, dependency vulnerability scanning, and static analysis on every code change. Remaining gaps are tracked openly.
Found a security issue? Please report it responsibly via our vulnerability disclosure policy.