Security & Trust
A plain account of how we protect your data, what is still to do, and how to tell us about a problem.
Last updated: October 2026
What is in place
Accounts and access
- Passwords are hashed with bcrypt (cost factor 12)
- New passwords are checked against known breaches, without sending the password anywhere (k-anonymity)
- Two-factor authentication (TOTP) is available, and it applies to every sign-in method
- Role-based access control (user, creator, admin, super admin)
- Sessions are bound to a device fingerprint when they refresh
- Repeated failed sign-ins lock the account for a while
- Session cookies are HttpOnly, so scripts on a page cannot read them
Data protection
- HTTPS only, with HTTP Strict Transport Security
- Connections from our servers to the database are encrypted and the database certificate is verified
- Payout and bank details are encrypted again in the application (AES-256-GCM)
- Card numbers never reach our servers: payments are made on the payment provider’s own hosted page
Application security
- A strict Content Security Policy with a fresh nonce on every request, and violation reports
- Framing is denied, content types are not sniffed, and camera, microphone and location are switched off by policy
- Cross-site request protection: cookies are SameSite and every state-changing request is checked against our own origin
- All input is validated on the server; unknown fields are rejected
- Rate limits on sign-in and on every public form, and a bot check on forms anyone can submit
- Webhook signatures are verified over the raw request body
- A security audit trail for privileged actions and sign-in events
How we build
- Five automated scans run before every release: secrets, static analysis, dependency advisories (two scanners) and container vulnerabilities
- Every change goes through a pull request; nothing is committed straight to the main branch
- Dependency advisories are fixed before release as soon as a patched version exists
What we have not done yet
We would rather tell you than let you assume. These are open items, not hidden ones.
- An independent penetration test. We will commission one before public sign-in opens.
- SOC 2 or ISO 27001 certification. We are not certified for either and do not claim to be.
- Signed data-processing agreements with every provider below. These are being put in place before accounts and payments open.
- Automatic deletion on a schedule for every kind of personal data. Retention periods are decided and the deletion jobs are being built.
Companies that process data for us
The data controller is RAMSIO CLOUDSERVE INFOTECH PRIVATE LIMITED. These providers handle data on our behalf. Some only become active when accounts and payments open.
| Provider | What it does for us |
|---|---|
| Amazon Web Services | Hosting, database, file storage |
| Cloudflare | DNS, TLS, content delivery, DDoS protection, bot check on forms |
| Sentry | Error monitoring, with personal data scrubbed |
| Resend | Sending email |
| GitHub | Source control and builds |
| Stripe and Razorpay | Card payments |
Report a vulnerability
If you find a security problem, please tell us privately so we can fix it before it is made public. We read every report.
Email: [email protected]
Scope: developerbootstrap.com and its subdomains. Please do not test against other people’s data.
We ask that you: give us reasonable time to investigate and fix before any public disclosure, and do not access, change or delete data that is not your own.
Your data rights
You can ask us what personal data we hold about you and ask for it to be corrected or deleted. Accounts are not open to the public yet, so for now email [email protected]; our Grievance Officer is Santhosh Suryavanshi.
Privacy PolicyQuestions about security or privacy? [email protected] · Privacy Policy · Terms of Service