Security is a system, not a badge.
Our program is informed by OWASP application and mobile security guidance, privacy-by-design principles, and platform requirements. This page describes controls in the product today. It is not a claim of formal OWASP certification or a guarantee that risk can be eliminated.
1. Data and media protection
- Network traffic is encrypted in transit using HTTPS and TLS.
- Infrastructure providers supply encryption at rest for managed database, storage, and AI systems.
- Photo objects are private and owner scoped. The application issues short-lived signed links instead of public media URLs.
- Original uploads and generated images are kept logically separate and identified distinctly in product interfaces.
- Media paths are normalized and validated before local or remote access to prevent traversal outside an owner's allowed area.
- Production account deletion fails safely if required media erasure does not complete, keeping the account available for a retry rather than falsely reporting success.
2. Identity, sessions, and access
- Supabase provides account authentication. The backend validates signed tokens and binds local accounts to the verified provider subject.
- Protected API endpoints require authentication and perform server-side ownership checks. Client-side route guards are a usability layer, not the security boundary.
- Authorization is scoped by user, task, goal, squad, photo, and other resource ownership as applicable.
- Premium features verify live server-side entitlement rather than trusting a client flag.
- Inactive accounts are rejected, and email metadata that a user can edit is not trusted for security-sensitive account linking.
3. Application and transaction controls
- Rate limits protect authentication, uploads, generation, exports, and other sensitive or expensive operations.
- Idempotency keys and event-order checks reduce duplicate AI charges, repeated task completion, and replayed subscription events.
- Subscription state is reconciled from cryptographically signed store notifications and direct server checks against Apple, Google, and Stripe.
- Generated media is validated, safety checked, and persisted before replacing an existing user result.
- Public errors avoid exposing raw database, provider, or internal exception details.
- Security headers restrict framing, content sources, browser permissions, referrers, and content-type interpretation on the website.
4. Service-provider boundaries
Glowgen uses specialized providers for identity and storage, AI processing, subscriptions, push notifications, hosting, and limited analytics. We minimize what is sent for each function, keep secrets on the server, and treat third-party responses as untrusted input that must be validated.
OpenAI's API policy states that API inputs and outputs are not used for model training by default unless an API customer explicitly opts in. Supabase documents encrypted transport and encrypted managed storage. Provider controls do not replace Glowgen's own authorization, retention, and deletion responsibilities.
5. Engineering and operations
- Secrets and local environment files are excluded from source control and are not shipped in client bundles.
- Automated tests cover authentication, authorization, billing events, account deletion, media boundaries, and failure recovery.
- Dependency checks, framework checks, migration checks, linting, and production builds are part of release verification.
- Logs are designed to avoid photo content, access tokens, full push tokens, and unnecessary personally identifying payloads.
- Database row-level policies add defense in depth around sensitive tables, while the Django API remains the product-data boundary.
We continue to improve monitoring, dependency governance, accessibility testing, provider retention settings, and incident readiness as the product matures.
6. Report a security concern
If you believe you found a vulnerability, email support@glowgen.ai with the subject "Security report." Include the affected URL or feature, steps to reproduce, expected and actual behavior, and the impact you believe is possible.
Do not access another person's data, run denial-of-service tests, use social engineering, publish an unresolved issue, or include passwords, tokens, payment data, or unnecessary personal content.
We will acknowledge actionable reports and coordinate next steps. This contact does not create a bug-bounty program or promise payment.