Security
Last updated:
This page describes the security controls sitewarm has in place today. It lists only what is true now; when a control changes, this page changes with it.
Hosting and encryption in transit
The sitewarm website and dashboard run on Cloudflare Workers. Cloudflare terminates TLS, and all traffic to the site uses HTTPS.
sitewarm is served from a .dev domain. The whole .dev top-level domain is on the HSTS preload list built into major browsers, so those browsers only connect to it over HTTPS.
Sign-in and access to the dashboard
Sign-in and organization management are handled by Clerk. Every dashboard page checks for a signed-in session on the server before it renders; signed-out visitors are sent to sign in.
Database
Account and product data is stored in a Neon PostgreSQL database in AWS us-east-2 (Ohio, United States). The website connects to it through Cloudflare Hyperdrive.
The database credentials the website uses are stored only in Cloudflare (Hyperdrive), never in source code. Encryption at rest is provided by Neon.
See Neon's security page.
Secrets and deploys
Deploy secrets are kept in GitHub encrypted environment secrets and Cloudflare Worker secrets.
Production is deployed only from the protected main branch, by CI that runs the test suite first and a smoke test against the live site afterward. CI jobs use least-privilege tokens with read-only access to the repository (contents: read).
Source maps are not shipped to browsers.
Source code and changes
The source repository is private. Direct pushes to main are blocked: every change reaches main through a pull request that must pass the required status checks.
Dependencies are monitored with Dependabot alerts.
Data from the sites sitewarm measures
sitewarm stores the URLs it measures and the response headers and timings it observes for each one.
sitewarm does not store cookie or Authorization header values from the sites it measures.
Reporting a vulnerability
If you find a security issue in sitewarm, email security@clarivo.co with a description of the issue and the steps to reproduce it. Our contact details are also published in /.well-known/security.txt.
Please give us reasonable time to investigate and fix the issue before you disclose it publicly.
sitewarm does not run a bug bounty program and does not pay for reports.
Sub-processors
The third-party companies that process data to run sitewarm are listed on the sub-processors page.