Security controls in Aglet.
Aglet separates accounts, limits machine access, removes recognized secrets before storage, and records sensitive changes. This page describes implemented controls; it does not claim an external certification.
Contact us about securityAccount and session controls
- Password protectionAccount passwords use Rails' password-hashing support. Passwords are not emailed or written to application logs.
- Email verificationNew accounts must verify their email before signing in to the app.
- Expiring sessionsSessions are stored server-side, expire after an absolute lifetime and inactivity window, and can be revoked. The browser cookie is encrypted and uses HttpOnly and SameSite attributes, with Secure enabled in production.
- Sign-in throttlingRepeated sign-in attempts are limited using separate, hashed IP and identifier dimensions.
- Request protectionsCookie-authenticated changes use CSRF protection, and the application defines a self-only content policy baseline with frame embedding denied.
Data and access controls
- Account boundariesProject records are loaded through the current account and checked against membership policies. Cross-account requests return a non-disclosing response.
- Secrets removed before storageThe event-processing code removes recognized secrets and sensitive fields before an event is saved or archived. Known sensitive parameter names are also filtered from logs.
- Machine access keysAglet stores one-way fingerprints of machine keys instead of retaining their readable secrets. Keys have limited permissions and can be revoked.
- Change historyAccount, access, work, and other sensitive operations record a history so the product can show what happened.
The limits of this page.
Do not send passwords, private keys, payment-card data, or regulated customer information through telemetry or feedback fields. Repository and deployment writes are not enabled at launch.
Aglet does not currently claim SOC 2, ISO 27001, or another external certification. Contact [email protected] with a security question or a report.
Have a security question?
Send the question or report to Remodeled AI, LLC.
Email [email protected]