Security

Last updated July 20, 2026

An honest overview of how RankVitals protects your data — no compliance theater, just what we actually do.

• Encryption in transit and at rest

  All traffic is TLS; data at rest is encrypted by our database and storage provider.

• Repository tokens

  GitHub tokens are encrypted app-side with AES-256-GCM, bound to their database row (AAD), stored in a table only the server role can read, and never logged. GitHub App connections store no token at all — short-lived tokens are minted per use.

• Row-level security

  Every table is protected by Postgres RLS; your team can only ever read its own rows, enforced in the database, not just the application.

• SSRF-guarded fetching

  Every URL the platform fetches — tests, crawls, webhooks, free tools — passes a DNS-resolving guard that blocks private, reserved, and cloud-metadata addresses.

• Webhook authenticity

  Inbound Stripe and GitHub webhooks are signature-verified (with timing-safe comparison) and deduplicated.

• Payments

  Handled entirely by Stripe — card data never reaches our servers.

• Least-privilege guidance

  We reject classic GitHub tokens and over-scoped fine-grained tokens at connect time, and recommend single-repository, contents-read-only grants.

• Security headers

  The app ships a restrictive Content-Security-Policy, HSTS, frame denial, and modern referrer/permissions policies.