Security at snarlmap
How we protect your code access tokens, session data, and personal information.
Encryption in transit
Traffic reaches snarlmap over HTTPS; TLS is terminated by Cloudflare, which connects to our server through a tunnel. We send a Strict-Transport-Security (HSTS) header.
Data storage
Sessions live in Redis, which is not written to disk. Subscription records live in PostgreSQL. API keys are stored only as one-way hashes. Session tokens are HS256 JWTs signed with a secret from the environment. We do not add our own at-rest encryption layer on top of the host disk.
OAuth security
We use the OAuth 2.0 Authorization Code flow with a signed state token (10-minute expiry) that is also bound to your browser by a cookie, to prevent login CSRF. Your GitHub access token stays on the server; the browser only holds a signed, httpOnly session cookie that JavaScript cannot read.
Token handling
We request the `repo` scope from GitHub, because GitHub offers no narrower option for private repositories. That scope technically allows writes; snarlmap only ever reads. The token is dropped when you sign out and expires after 7 days regardless.
Responsible disclosure
If you discover a security vulnerability in snarlmap, please report it responsibly to [email protected]. We ask that you give us 90 days to address the issue before public disclosure.
We do not run a paid bug bounty. We will credit you publicly for a valid report if you want that.
snarlmap runs in Docker containers as a non-root user behind Nginx with rate limiting. Our CI runs pip-audit on the Python dependencies before each deploy.
Security questions? Contact us or email [email protected]