Security
The security controls we actually ship.
No badges we haven't earned. Here's what's in the code today — and since it's open source, you can check.
Hashed sessions and API keys
Session tokens and API keys are stored as hashes. A database leak doesn't hand out working keys. Keys are shown once when created.
AES-GCM encrypted credentials
Provider credentials are encrypted with AES-GCM before they're written, and never sent back to the browser.
HMAC webhook verification
Webhook triggers require an HMAC-SHA256 signature over the timestamp and raw body, with a 5-minute tolerance against replays.
Rate limits
Authentication, public forms, webhooks and the API are rate limited. Public forms are also protected by Cloudflare Turnstile.
Content Security Policy
The site and app ship a strict CSP: no inline scripts, no third-party fonts or trackers.
Tenant isolation
Every record is scoped to an organization, and the server checks membership on every request. Organization IDs from the browser are never trusted on their own.
Masked logs
Values that look like secrets — tokens, passwords, authorization headers — are masked before execution logs are stored.
Role-based access and audit logs
Owners, admins and members have different permissions. Important changes are written to an audit log.
Infrastructure
- Runs on Cloudflare Workers, D1, Queues, Durable Objects and R2.
- TLS everywhere; Cloudflare's network handles DDoS mitigation.
- Workflows can't run arbitrary user code. AI drafts need human approval to publish.
- Non-idempotent actions (payments, messages) are never blindly retried.
What we don't have yet
- No SOC 2, ISO 27001 or other certification. We won't claim one until an auditor has signed it.
- No SSO or SCIM yet.
- No formal bug bounty yet.
Report a vulnerability
Email hello@outcomeos.cloud with “Security” in the subject, steps to reproduce, and the impact you expect. Please give us reasonable time to fix it before disclosure, and don't access other customers' data or degrade the service while testing. We'll acknowledge reports within [3 business days — set by owner before launch].
Read the code on GitHub, or see the Privacy Policy for how data is handled.