Security
Last updated: May 6, 2026

Your code security is our top priority.

We've built ShipRelease with a security-first mindset. Here's everything you need to know about how we protect your data.

Your code is never stored

Code diffs are processed entirely in memory and discarded immediately after generation. We never write your source code to disk or database.

GitHub tokens encrypted at rest

OAuth tokens are encrypted using AES-256 (pgcrypto) in our database. Decryption only happens server-side, never exposed to clients.

Row-Level Security

Every database table is protected by Supabase RLS policies. Users can only ever access their own data enforced at the database level.

Rate limiting on all endpoints

All API routes are protected by sliding-window rate limiters via Redis. Brute-force and DDoS attacks are blocked before reaching our servers.

Data handling

We collect and store only what is strictly necessary to provide the ShipRelease service:

  • Your GitHub username, email, and profile required for authentication.
  • Repository metadata (name, owner, default branch) required to list your repos.
  • Generated release notes stored so you can access your history.
  • Usage counters (releases per month) required to enforce plan limits.
  • Audit logs (action, timestamp, IP) required for security monitoring and Business plan compliance.

We do not store: your source code, raw diffs, commit messages, or any file contents. These are processed in memory per request and immediately discarded.

Authentication

ShipRelease uses GitHub OAuth exclusively there are no passwords to leak or brute-force. OAuth tokens are:

  • Encrypted with AES-256 before storage using PostgreSQL pgcrypto extension.
  • Decrypted server-side only, in API routes never sent to the browser.
  • Scoped to the minimum required permissions: read:user, user:email, repo (read-only unless you publish a GitHub Release).
  • Sessions expire after 7 days and require re-authentication.

Infrastructure security

  • Hosted on Vercel (edge network) with automatic DDoS protection at layers 3 and 4.
  • Database hosted on Supabase with automatic daily backups and point-in-time recovery.
  • All traffic encrypted in transit via TLS 1.3.
  • HSTS with preload enabled on all domains.
  • Content Security Policy (CSP) headers on all pages.
  • X-Frame-Options: DENY to prevent clickjacking.
  • All API inputs validated with Zod schemas before processing.
  • Chariow webhook signatures verified before any payment event is processed.

Third-party services

ShipRelease uses the following third-party services. Each is evaluated for security compliance:

Anthropic Claude API

AI generation

Prompts are not used to train Anthropic models (API usage). Diffs sent are ephemeral.

GitHub OAuth

Authentication

Industry-standard OAuth 2.0. We request minimum necessary scopes.

Supabase

Database & auth

SOC 2 Type 2 certified. Data stored in EU/US depending on your region.

Chariow

Payments

Secure hosted checkout. We never see or store your card details.

Vercel

Hosting & CDN

SOC 2 Type 2 certified. Edge-network DDoS protection included.

Reporting a vulnerability

If you discover a security vulnerability in ShipRelease, please email us at helloshiprelease@gmail.com. Please do not open a public GitHub issue for security vulnerabilities.

  • We will acknowledge receipt within 24 hours.
  • We will provide a status update within 72 hours.
  • We will notify you when the issue is resolved.
  • We credit researchers who responsibly disclose issues (with permission).