Security

1. Read-only by design

Ship & Shout only ever reads. From your code host we read commit metadata and merged pull requests — never file contents. From your payment processor we read revenue totals and new / churned customer counts — we never move money. From analytics we read aggregate visitor counts. The single write action anywhere in the product is one you initiate yourself: publishing a finished post to your own LinkedIn feed.

2. Least-privilege OAuth scopes

We request the narrowest scopes each provider offers, and read-only wherever available:

• GitHub: read-only access to commit metadata and merged pull requests. No repo write, no contents scope.
• GitLab / Bitbucket: read-only repository activity scopes only.
• Stripe / Lemon Squeezy: read-only access to revenue totals and customer counts. No write, no payout, no charge permissions.
• Plausible / Vercel Analytics / Fathom: read-only access to aggregate visitor stats.
• LinkedIn: only the permission to publish a post you explicitly choose to publish.

We never request or receive access to your source code.

3. Encryption in transit and at rest

All traffic to and from Ship & Shout is encrypted over TLS. Sensitive data at rest — your third-party access tokens — is encrypted with AES-256-GCM using a key held in our server environment, separate from the database.

4. Token handling

• Tokens are encrypted with AES-256-GCM before they are stored.
• They are decrypted only server-side, only at the moment they are used to fetch your metrics.
• They are never written to logs.
• They are never sent to the browser or exposed to client code.
• We send our LLM providers only summarized metrics — never your tokens or raw source data.

5. Row-Level Security on every table

Our database (Supabase Postgres) enforces Row-Level Security on every table. Policies tie each row to its owner so one user can never read or write another user's data, even if application code had a bug. Server actions independently verify the authenticated user before acting. Charts are stored in Supabase Storage under the same access controls.

6. One-click revoke

You can disconnect any source at any time from Settings, which destroys the stored token immediately. You can also revoke Ship & Shout's access directly from each provider's own connected-apps settings. Deleting your account destroys all tokens at once — see GDPR & Your Data.

7. Infrastructure

Ship & Shout runs on managed, reputable infrastructure: Supabase for database, auth, and storage; Vercel for hosting and the weekly cron job; Lemon Squeezy as merchant of record for billing; and Resend for transactional email. We prefer boring, well-understood building blocks over custom infrastructure, and keep the number of systems that touch your data small. Our full provider list is in the Privacy Policy.

8. Responsible disclosure

If you believe you've found a security vulnerability, we want to hear from you. Email security@shipandshout.co with steps to reproduce. Please give us a reasonable window to investigate and fix before public disclosure, and avoid accessing or modifying other users' data during your testing. We will acknowledge your report and keep you updated on the fix.

9. Compliance posture

We are built to support the GDPR: data minimization, read-only access, clear legal bases, Standard Contractual Clauses for international transfers, and self-serve export and deletion. Every draft is generated by automated tools but reviewed by a human before publishing, so there is no automated decision-making with legal effect. Our data practices are described in the Privacy Policy and GDPR & Your Data pages.

10. Contact

Security reports: security@shipandshout.co. Privacy questions: privacy@shipandshout.co. General help: hello@shipandshout.co.