Security

How Wrenship keeps your apps and data apart from everyone else's, what's checked on every deploy, and how to report a problem.

The short version

• Every deploy is scanned for leaked keys before it goes live, and a .env file is never published.
• Builds run in a fresh sandbox that is thrown away afterwards.
• Every app runs in its own sandbox on the edge, with no access to other customers' apps or data.
• Secrets are encrypted with a key that belongs to your workspace.
• Databases and files are private to your project unless you make a file public.

How traffic reaches your app

Every request lands on the edge location nearest the visitor. TLS, caching and DDoS protection happen there, before anything reaches your app. Every site gets an SSL certificate automatically, including custom domains.

Builds

Each build runs in a one-time sandbox with only your code and the variables scoped to that deploy. When the build finishes, the sandbox is destroyed. Before anything is published, the output is scanned for API keys, tokens and passwords in public files. Anything found is shown on the build page with a suggested fix.

Your apps and data

• Apps run in isolated sandboxes. They can reach the internet and their own project's database, files and key-value store, nothing else.
• SQLite databases are reachable only from your app and the dashboard, never from the internet.
• Postgres databases each have their own login, which can't see any other database. Connections use TLS.
• File storage is served from your own site. The private/ folder is never public, and uploaded HTML or SVG files are offered as downloads, so they can't run as pages on your site.
• Environment variables are encrypted with your workspace's own key. Secret values are hidden in the dashboard, revealing one is recorded in the activity log, and AI apps never see them.

Watching for abuse

New sites are checked against Google Safe Browsing every day. Anyone can report abuse. Confirmed abuse is taken down under our Acceptable use policy.

Your account

• Sign in with GitHub, Google or an email code, and add a passkey to skip the email next time. Passkeys are phishing-resistant and recommended for owners.
• Roles (owner, admin, developer, viewer) decide who can deploy, read logs or see secrets.
• Everything that changes your projects, from a person or an AI app, is in the activity log.

Reporting a vulnerability

Email security@wrenship.com with the details. Please give us a reasonable time to fix it before you share it. We don't take legal action against good-faith research that respects our users' data and stays within our Terms.