Encryption
- In transit: the website and API use HTTPS.
- Storage: project data is stored in Neon and Cloudflare R2. Access is restricted by the application and storage credentials.
- Provider credentials: service keys remain on the server and are not included in the browser editor.
Access controls
- Project assets are scoped per-user — no cross-tenant access.
- Generation, saving and export requests require an authenticated account.
- Generation requests may remain in project and job records; see the retention policy.
Privacy
- For data access, correction and deletion requests, see our privacy policy.
Responsible disclosure
Found a security issue? Please email security@shotshq.com.
Include the affected page, steps to reproduce and the impact you observed. We review reports and coordinate next steps with the reporter. We will ask your permission before publicly crediting you.
Please don't exploit or share vulnerabilities before we've had a chance to fix them.