Security

1Found a problem in Redproof?

We check other people's apps for a living, so we want to hear about problems in ours. Email hello@redproof.dev with "Security" in the subject, what you found and how to reproduce it. We confirm within 3 working days and keep you updated until it is fixed.

If you act in good faith and follow the rules below, we will not take legal action against you, and with your permission we will thank you by name once the problem is fixed.

2Rules for testing

Only test against reports and scans you created yourself. Do not access, change or delete other people's data, and stop as soon as you see any.

Do not run denial-of-service or load tests, send spam, or use social engineering against us or our providers.

Give us reasonable time to fix a problem before you tell anyone else about it.

3How we protect your code

Submitted code is read as text and never executed. GitHub repositories are downloaded into memory only for the scan; uploaded zips are deleted within 7 days.

Secrets found in code are masked before anything is stored or sent to the AI review. Reports live behind long random links and are hidden from search engines.

Servers run in Amazon Web Services in Frankfurt, Germany, with encrypted connections, firewall rules that allow only web traffic, and server logs kept for 30 days.