Skip to content
Founding beta: 7 of 50 free spots leftClaim yours
AICodingRound
Sign up freeSign up

Security

How we protect your account, code and keys, and how to report a vulnerability responsibly.

Last updated 28 October 2026

How we protect data

  • Accounts: passwords are hashed with Argon2id, checked against a list of breached passwords, and never stored or logged. Optional two-factor (TOTP) with recovery codes; staff accounts require it.
  • Sessions: HttpOnly cookies, rotated on login, with idle and absolute timeouts. You can see your devices and sign out everywhere. Password reset links are single-use and expire in 30 minutes.
  • Requests: CSRF protection on every write, strict Content Security Policy, HSTS in production, and rate limits with backoff on sign-in.
  • Access control: every workspace, file, report and key belongs to one user, and every route checks that. We test cross-user access on each route.
  • Secrets: AI keys and logins you add are encrypted at rest and never shown back to you or written to logs.
  • Workspaces: your code runs in an isolated sandbox with limits on time and resources, separate from other users and from our own systems.
  • Audit trail: sensitive account actions are logged, with a shortened IP address.
  • Retention: recordings, logins, logs and deleted accounts are removed on a fixed schedule by an automatic job; see the privacy policy for each period.

What we have not done yet

We are in private beta. An independent security review of the whole service is planned before public launch, and we will publish a summary when it is done. Some items, such as tested restores from backup and sign-in with GitHub and Google for everyone, are still on the list.

Your part

Use a unique password or a password manager, turn on two-factor in settings, and do not put real customer data or production secrets into a practice workspace.

Responsible disclosure

If you find a vulnerability, please write to security@aicodinground.com. Our security.txt has the same contact.

  • Give us a reasonable time to fix the issue before telling anyone else.
  • Test only your own account and workspaces. Do not access, change or delete other people’s data, and do not degrade the service.
  • Send enough detail to reproduce it: what you did, what you saw, and the URL or request.

We will acknowledge your report within three working days, keep you updated, and credit you if you wish. We will not take legal action against good-faith research that follows these rules. We cannot pay bounties yet.