Security

01Protecting the site

Every page is sent over HTTPS with a strict Content Security Policy that only allows scripts, styles and images from our own server, with no inline scripts and no third-party code. Pages also forbid framing by other sites, disable content-type sniffing, limit the referrer information browsers share, turn off access to the camera, microphone and location, and tell browsers to use HTTPS only.

Forms only accept submissions from our own origin, reject oversized requests and limit repeated attempts from the same connection.

02Accounts and sign-in

Passwords are hashed with Argon2id and never stored as text. Sign-in is rate-limited and an address locks for 15 minutes after repeated failures. Session cookies are HttpOnly and SameSite, every form is protected against cross-site requests, and resetting your password signs out every session. Invitation, reset and verification links work once, expire, and are stored only as digests.

03Payments

Payments are handled by Stripe on Stripe’s own checkout and billing pages. Your card details go straight to Stripe and never reach Outpost’s servers. Outpost only accepts payment events that carry Stripe’s signature, and handles each one once.

04Connected accounts

When you connect Cloudflare, Google Search Console or a social network, Outpost asks for the least access it needs: read-only for Search Console, and for Cloudflare a token limited to one zone. Outpost refuses a Cloudflare token that can do more than that. Tokens are encrypted at rest with AES-256-GCM, each bound to the one connection it belongs to, are never shown again after you add them, and are deleted when you disconnect.

Every change Outpost makes on your behalf, such as a DNS record or a post, is recorded with a receipt, and DNS changes can be undone from that receipt. LinkedIn posts go out only when you press Post now, and nothing is posted to Reddit for you.

05Isolation and access

When Outpost fetches a web page, for example during an audit, it only connects to public internet addresses, never to private or internal networks. Page screenshots are taken in throwaway, hardened containers (a non-root user, a read-only filesystem, no extra privileges, replaced after a set number of pages) on an internal network with no direct route out: they reach public websites only through a filtering proxy. They share that network with Outpost’s worker, which tells them which page to load, and they store none of your data.

Your workspace’s data is kept separate from every other workspace’s. Outpost staff can see operational information about background jobs; every action staff take on a job is logged with who did it and when. Logs mask secrets and email addresses.

06Reporting a vulnerability

If you believe you’ve found a security issue, please email security@outposttraffic.com with the steps to reproduce it. We’ll acknowledge your report, keep you updated while we fix it, and credit you if you’d like.

Please act in good faith: don’t access or change other people’s data, don’t degrade the service (no denial-of-service or spam), and give us reasonable time to fix the issue before sharing it publicly.