Public-source security
Small surface. Explicit boundary.
The open-source catalogue needs no customer database or payment runtime. Production hosting, identity, database, email, monitoring and backup adapters are connected behind server-only controls; paid source, credentials and customer data remain outside the public repository and build.
Current controls
- Public registry payloads are generated only from allowlisted public source paths.
- Paid Pro source must never enter the public repository or build output.
- Health output contains no secrets or private diagnostics.
- Type checking, dependency locking, lint, tests, and production builds are release gates.
- Production identity, database, email, monitoring and backup adapters are server-only. Checkout remains disabled until the restricted Stripe runtime key, release archive and complete customer journey pass.
- Protected-download and webhook contracts require current server authorization, signed and replay-resistant evidence, and verified provider events; their public routes return indistinguishable unavailable responses until paid launch gates pass.
Vulnerability reporting
Email support@kreydlabs.com with Security report in the subject. Do not submit sensitive vulnerability details through a public issue. Include affected URLs, impact and reproducible steps, but never include another person's data or a destructive proof.
We aim to acknowledge a valid report within two UK business days. This is a target, not an SLA or a bug-bounty promise. Do not access unnecessary data, disrupt service, use social engineering or demand payment.
Commercial infrastructure
Vercel serves the production origin; WorkOS, Convex, Resend, Better Stack and Backblaze B2 are configured behind it. Stripe products, prices and signed webhooks exist, but checkout stays disabled while its least-privilege runtime key and the protected paid release remain gated. Configuration alone is not treated as evidence of a complete customer journey.