LofentaLofenta/Legal
Dashboard

Legal

Security

How we protect your apps and data, how often we check, and how to report a vulnerability.

Last updated: November 8, 2026

How we protect Lofenta

Security is part of how we build and run Lofenta every day, not a yearly checkbox. This is what is in place today.

  • Protected edge. All traffic to Lofenta and to the apps you deploy passes through our own filtering layer first. It absorbs floods, rate limits abusive clients and challenges suspicious traffic before it reaches your app.
  • Isolated apps. Every app runs in its own container, and every request to a project is checked against your role in it (viewer, developer, admin, owner) on the server, every time.
  • Strong sign-in. Passkeys, two-factor authentication with replay protection, Sign in with Apple, and single-use magic links. Sign-in attempts are rate limited, and you can see and end every active session from your account.
  • Secrets handled carefully. Values stored in the Lofenta ID Vault are encrypted, and every reveal is written to an audit log. API keys are stored only as hashes and checked in constant time, so they cannot be read back, not even by us.
  • Encrypted connections. Every Lofenta page, API and deployed app is served over HTTPS with certificates issued and renewed automatically.
  • Proof of domain ownership. A custom domain only goes live after you prove you control it with a DNS verification record, so nobody can attach a domain that is not theirs.
  • Backups we actually test. Backups are copied off-site, and automated drills restore them every week to prove they work.
  • Abuse monitoring. We watch for crypto mining, abnormal traffic and sign-up abuse, and pause what is harmful before it affects other customers.

How often we check

  • Every change. Code that touches sign-in, permissions, billing or customer data is reviewed for security before it ships, then tested on a private preview before it reaches production.
  • Every release. Production changes are type-checked, backed up and health-checked on the way out, and roll back automatically when a check fails.
  • Every week. Backup restore drills, plus a review of edge and abuse alerts.
  • Regular full reviews. We audit the whole product area by area, see below.

Live uptime and incident history are public on our status page.

Reporting a vulnerability

If you believe you have discovered a security vulnerability in Lofenta or any of our services, please email [email protected] with a description of the issue and steps to reproduce. Encryption with our PGP key is optional.

Please do not publicly disclose the issue, run automated exploits at scale, exfiltrate user data beyond the minimum needed to demonstrate the issue, or impact service availability. We follow the spirit of coordinated disclosure.

What we commit to

  • Acknowledge receipt within 2 business days.
  • Provide a triage decision (in-scope / out-of-scope / duplicate) within 5 business days.
  • Keep you informed of progress until the issue is resolved or formally closed.
  • Credit you on the acknowledgments list below if you wish (opt-in).
  • Not pursue legal action for good-faith research that follows this policy.

In scope

  • lofenta.com, *.lofenta.com, *.lofenta.app
  • The Lofenta CLI (@lofenta/cli on npm)
  • Any service we operate that handles customer data

Out of scope

  • Customer-deployed applications running on Lofenta (report those to the project owner)
  • Theoretical issues without practical exploitability
  • Missing best-practice headers when no concrete attack vector is shown
  • Self-XSS or social-engineering attacks
  • Volumetric DDoS testing (always out)
  • Third-party services (Cloudflare, GitHub, OxaPay). Report those directly to them.

Last internal security review

Lofenta's engineering team runs internal security reviews on the production surface: authentication flows, authorization gates on every state-changing endpoint, the deploy runner, customer-data paths, and outbound integrations. Reviews include code audit + an active red-team pass against a fresh non-admin account attempting privilege escalation, IDOR, SSRF, account enumeration, OAuth / 2FA bypass, and known framework CVEs.

Most recent full review completed in November 2026, covering every area of the product: sign-in and accounts, billing, projects and deployments, teams, DNS and domains, the CLI and Lofenta ID. All issues found in scope were fixed before this page was updated. We do not publish specifics of past findings. If you are evaluating Lofenta as a vendor and need a summary letter under NDA, email [email protected].

Encryption

Acknowledgments

Researchers who responsibly disclose a valid issue are listed here with their consent. No vulnerabilities have been disclosed under this policy yet. Be first.

Related