Security

1. What we read

Ship & Shout only ever reads. From your code host we read commit metadata and merged pull requests — never file contents. From your payment processor we read subscriptions, orders, and customers with a restricted, read-only key you create — we use them to compute revenue and new / churned customer counts, and we never move money. From analytics we read aggregate visitor counts. The only thing Ship & Shout ever publishes is a finished post you launch yourself, to the accounts and channels you picked (for example LinkedIn, Bluesky, Mastodon or Discord).

2. OAuth scopes, honestly

Here is exactly what each provider grants, and what we actually do with it:

• GitHub: the Ship & Shout GitHub App, installed only on the repositories you choose, with read-only permissions (Contents, Pull requests, Metadata). We read commits, merged pull requests, and releases — never write — and you can uninstall it anytime from your GitHub settings under Applications.
• GitLab: read_api, a genuinely read-only scope. Bitbucket: repository, also read-only.
• Stripe: a restricted, read-only API key you create — we show you how. Lemon Squeezy: an API key you create (Lemon Squeezy has no read-only key type), which we only ever use for read requests. With them we read subscriptions, orders, and customers to compute revenue and customer counts. We never write, refund, or charge.
• Plausible: read-only access to aggregate visitor stats.
• LinkedIn, Bluesky, Mastodon and other publishing targets:only what is needed to publish a post you explicitly choose to launch.

We never fetch your source code — only commit and pull request metadata.

3. Encryption in transit and at rest

All traffic to and from Ship & Shout is encrypted over TLS. Sensitive data at rest — your third-party access tokens — is encrypted with AES-256-GCM using a key held in our server environment, separate from the database.

4. Token handling

• Tokens are encrypted with AES-256-GCM before they are stored.
• They are decrypted only server-side, only at the moment they are used to fetch your metrics.
• They are never written to logs.
• They are never sent to the browser or exposed to client code.
• We send our LLM providers only summarized metrics — never your tokens or raw source data.

5. Row-Level Security on every table

Our database (Supabase Postgres) enforces Row-Level Security on every table. Policies tie each row to its owner so one user can never read or write another user's data, even if application code had a bug. Server actions independently verify the authenticated user before acting. Charts are stored in Supabase Storage under the same access controls.

6. One-click revoke

You can disconnect any source at any time from Settings, which destroys the stored token immediately. You can also revoke Ship & Shout's access directly from each provider's own connected-apps settings. Deleting your account destroys all tokens at once — see GDPR & Your Data.

7. Infrastructure

Ship & Shout runs on managed, reputable infrastructure: Supabase for database, auth, and storage; Vercel for hosting and the weekly cron job; Lemon Squeezy as merchant of record for billing; and Resend for transactional email. We prefer boring, well-understood building blocks over custom infrastructure, and keep the number of systems that touch your data small. Our full provider list is in the Privacy Policy.

8. Responsible disclosure

If you believe you've found a security vulnerability, we want to hear from you. Email security@shipandshout.com with steps to reproduce. Please give us a reasonable window to investigate and fix before public disclosure, and avoid accessing or modifying other users' data during your testing. We will acknowledge your report and keep you updated on the fix.

9. Compliance posture

We are built to support the GDPR: data minimization, we only ever read, clear legal bases, Standard Contractual Clauses for international transfers, and self-serve export and deletion. Every draft is generated by automated tools but reviewed by a human before publishing, so there is no automated decision-making with legal effect. Our data practices are described in the Privacy Policy and GDPR & Your Data pages.

10. Contact

Security reports: security@shipandshout.com. Privacy questions: privacy@shipandshout.com. General help: hello@shipandshout.com.