Security
The controls we run, and how to tell us when one of them is not enough.
Controls
Encryption at rest
Stored data, including backups, is encrypted on disk.
Encryption in transit
TLS everywhere, enforced with HSTS and automatic certificate renewal.
Secret handling
Environment variable values are stored encrypted and never returned by the API.
Least privilege
Internal services and credentials are scoped to what each one needs.
Audit logging
Administrative and billing actions are recorded, available on enterprise plans.
Backups
Automated backups with point-in-time recovery for managed databases.
Dependency hygiene
Dependencies are pinned and updated on a regular cadence.
Responsible disclosure
A published contact for security reports, with acknowledgement guaranteed.
Reporting a vulnerability
Please report security issues by email rather than by opening a public issue. We acknowledge every report within one business day and will tell you what we find. We do not pursue good-faith researchers.
security@hihemax.com
Response
Acknowledged within 1 business day
Severity
Rated after triage, not by the reporter
Credit
Issued where warranted