Security

CrescoDB is local-first by design, so most of your work never leaves your machine. For the hosted parts — your account and CrescoDB Cloud — this page explains how we protect your data and how to report a vulnerability.

How we protect your data

• Encryption at rest. Sensitive CrescoDB Cloud data — server SSH keys, environment variables, per-deployment secrets, and connected provider tokens — is encrypted with AES-256-GCM before it's stored.
• Secrets stay out of logs. Secrets and access tokens are redacted from the build and runtime logs you view.
• Short-lived, scoped access. Git deploys use a GitHub App with fine-grained, per-repository permissions and short-lived tokens minted on demand — not a broad, long-lived token. PaaS deploys run under your own provider account.
• Hashed credentials. Passwords and the backup-retrieval password are stored only as salted hashes, never in plaintext.
• Session hygiene. Access tokens are short-lived with rotating refresh tokens; sign-out revokes them server-side. Email links are single-use and expire.
• Least data. Your app's data lives on your own server or provider, not on our infrastructure — we orchestrate deployments, we don't host your database.
• Server access. When you connect a server, we create a locked-down deploy user and pin the host key on first connect to detect tampering.

Reporting a vulnerability

If you believe you've found a security issue, please tell us before disclosing it publicly. Email security@crescodb.com with:

• A clear description of the issue and its potential impact.
• Steps to reproduce it (a proof-of-concept helps).
• Any relevant URLs, requests, accounts, or logs — using test data where possible.

We aim to acknowledge reports within a few business days and will keep you updated as we investigate and fix the issue. We're a small team, so please be patient — we take every report seriously.

Please do

• Test only against your own accounts and data.
• Give us a reasonable chance to fix an issue before disclosing it.
• Stop and report if you encounter someone else's data.

Please don't

• Access, modify, or delete data that isn't yours.
• Run denial-of-service tests, spam, or automated scanning that degrades the service for others.
• Use social engineering, phishing, or physical attacks against our team or infrastructure.
• Publicly disclose a vulnerability before we've had a chance to address it.

Safe harbor

If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you for your research, and we'll treat your report as authorized testing. If in doubt about whether something is allowed, ask us first at security@crescodb.com.

See also our Privacy Policy and Acceptable Use Policy.