asincly

This instance hasn’t set its operator’s details (the LEGAL_* environment variables), so the bracketed placeholders below are not filled in.

Legal

Security

Reporting a vulnerability

Please don’t open public GitHub issues for security problems. Email [security email — set LEGAL_SECURITY_EMAIL] with what you found, how to reproduce it, and the version or URL affected. We acknowledge within 2 business days and aim to fix high-severity issues within 30 days. Coordinated disclosure appreciated; we credit reporters who want it. Machine-readable contact: /.well-known/security.txt.

In scope

  • Anything that lets one team or organization read, change or delete another’s data
  • Getting a recording, transcript or summary without access to its team
  • Authentication bypass, session fixation, sign-in link replay, two-factor bypass
  • SSRF, RCE, SQL or template injection, XSS that runs under our Content-Security-Policy
  • Secrets or personal data leaking into logs, error pages or client bundles

Out of scope

  • Denial of service by traffic volume; social engineering; physical attacks
  • Findings that need a compromised device or browser

How Asincly protects data

  • Every request runs as the signed-in person under Postgres row-level security keyed on team membership; code that bypasses it is limited to a reviewed list.
  • Transcripts, summaries, AI drafts, Slack tokens and 2FA secrets are encrypted with AES-256-GCM, bound to their record, with a rotatable key.
  • Recordings upload from the browser straight to private storage, with the size fixed in the signature; playback links expire within minutes.
  • Optional TOTP two-factor (required per organization for owners and admins), session management, and enforced Google SSO per domain.
  • Rate limits on sign-in, uploads, AI processing and exports, shared across all instances.
  • A nonce-based Content-Security-Policy, HSTS, and framing denied.
  • An audit log of administrative actions: role and ownership changes, exports, deletions, security settings.
  • Personal data kept out of logs; dependency advisories checked in CI.