Enterprise-Grade Security by Default

1. Database Row Level Security (RLS)

Every table in our cloud database (`bookmarks`, `collections`, `logs`) enforces cryptographic Row Level Security in PostgreSQL.

• Even if an application layer endpoint is misconfigured, the PostgreSQL engine itself strictly blocks reading, modifying, or deleting rows where auth.uid() != user_id.
• Data is partitioned per tenant, eliminating cross-user contamination risks entirely.

2. Multi-Layer SSRF Protection Engine

When fetching metadata previews for saved URLs, our scraper evaluates every target destination before dispatching an HTTP request:

• Loopback & Localhost Block: Rejects 127.0.0.0/8, localhost, and ::1.
• Private Network Block: Rejects RFC 1918 subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Link-Local & Cloud Metadata: Rejects AWS/GCP instance metadata endpoints (169.254.169.254).
• Scheme Whitelist: Only outbound requests on https:// or http:// are permitted. Internal schemes such as file://, gopher://, or data: are rejected.

3. Hardware Keyring Storage

On mobile devices, access tokens and refresh secrets are never stored in plaintext preferences. StashHaven leverages:

• Apple iOS: iOS Keychain with kSecAttrAccessibleAfterFirstUnlock.
• Google Android: Android Keystore System with AES-256 GCM hardware-backed master encryption keys.

4. Zero-Retention StashMind

StashMind is an AI-powered assistant operating through private, zero-retention enterprise API endpoints:

5. Automated PII & Credential Scrubbing

Client error telemetry passes through a multi-pass regex sanitizer before dispatch. The sanitizer automatically detects and redacts:

• Email addresses ([REDACTED_EMAIL])
• Bearer tokens and API keys ([REDACTED_TOKEN])
• Password fields and authentication cookies ([REDACTED_PASSWORD])

6. Responsible Vulnerability Disclosure

We welcome vulnerability reports from security researchers. If you identify a potential security vulnerability, please submit your findings to our security response team: