Stackbrace holds the record of who controls every layer of the sites you look after. That record is useful to you for the same reason it would be useful to an attacker, so this page says plainly what Stackbrace does with it, what it will never hold, and how to tell us if something is wrong.
Towards the sites it watches
- Read-only, always. Stackbrace makes only the requests a visitor or a search engine makes: fetches of public pages, DNS lookups, a certificate handshake. It never tries to log in, never posts to a site, never guesses paths beyond a fixed list of well-known ones, and changes nothing. It follows robots.txt past the homepage and names itself on every request. What it asks for, and from where.
- It never holds a login for your sites. The record says where a login is kept: a vault entry, a person, a password manager. The login itself is never asked for and has no column to be stored in. The one exception is a read-only connection to GitHub, made through GitHub’s own app installation, with tokens that last an hour and are asked for only when a repository is read.
- Specifics go only to the owner. Anyone can check a domain and learn what kind of problems it has. Which account, which version, which file is shown only to someone who has proved control of the domain with a DNS record or a file on the site. The cut is made on the server, so an unproved visitor’s browser never receives it.
- It asks as Google only with consent. Finding spam shown only to search engines means asking as Google would. Stackbrace does that only for sites whose owner has proved them.
The record
- Passwords are hashed with scrypt and never stored. Health-card links and emailed links are stored only as SHA-256 hashes of their random tokens, so a copy of the database cannot open them.
- Secrets you give Stackbrace, such as a Slack token or a heartbeat address, are sealed with AES-256-GCM under a key derived from a server secret, and never shown again after saving. Two-factor secrets are sealed the same way; recovery codes are hashed.
- The registry itself is stored in PostgreSQL on a single server in Hetzner’s Helsinki data centre, reachable only from the application. Backups are encrypted with age before they leave the server and are kept for 14 days; a deleted account is gone from them within 30 days.
- In transit everything is HTTPS. The app tells browsers to use HTTPS only, refuses to be framed, and sends no referrer to other sites.
- Nothing from another company runs inside the app. Visits to the public pages are counted by Stackbrace itself, without a cookie. The pages you use once logged in load no outside script at all.
Who can get in
- Two-factor login with an authenticator app is available to every account and advised for all; once on, it cannot be switched off by anyone but the person, and moving it to a new phone needs the old one or a recovery code.
- Roles. Owners manage people and settings, editors change the record, viewers read, and a client sees only the health cards of their own sites. The last owner can neither be demoted nor removed.
- Sessions are tied to the password they were opened with: changing it, or turning on two-factor, ends every other session. A session lasts 30 days from login and is not extended by use. Wrong passwords and wrong codes are counted and locked out.
- Leaving. Anyone can download what Stackbrace holds about them and delete their login; an owner can export everything in an account and delete it.
Who else handles data
Email goes through Resend, payments through Dodo Payments, and alerts to Slack when you connect it. Scans ask Google Web Risk, WordPress.org and Team Cymru about your sites’ addresses and software, never about you. The privacy policy lists each one and what it receives.
Reporting a vulnerability
If you find a weakness in Stackbrace, write to Vincent@codeandvin.com with what you found and how to reproduce it. You will get a reply from a person within two working days, and a fix as fast as it can be made. Please give us time to fix it before publishing, do not read or change data that is not yours, and do not test against sites Stackbrace watches that are not your own. We do not pursue researchers who follow these lines. The same address is published at /.well-known/security.txt.
What is not done yet
Stackbrace is built and run by one person. There is no SOC 2 report and no penetration test by an outside firm; the server’s disk is not encrypted beyond what the hosting provider does, and a second checker location is still to come. This page will say when those change.