How your secrets are kept

Launchpad holds keys that can change your infrastructure, so how they're kept matters more than almost anything else it does. This is what's in place today, and what isn't yet.

Your provider keys

• Encrypted before they're stored, each value sealed to its own place, so a value lifted from the database can't be opened elsewhere.
• Never shown again. The console shows a key's name and when it was saved. To change one, you paste a new value over it.
• Never in a log. Every value a deploy touches is scrubbed from its log, including when a provider's error message quotes a key back.
• Removable any time, in Connections or by revoking at the provider.

Scope

• The Connect buttons ask the provider for scoped access rather than a token that can do anything.
• The Cloudflare token's permissions are listed for you per app, so you don't grant more than the app uses. See Connect your accounts.
• App keys for R2 storage come from a token scoped to that app's own buckets.
• The email key Launchpad creates is send-only and scoped to your domain.

Sign-in and the console

• Sign-in is through GitHub, so your GitHub two-factor login protects the console too.
• Sessions are stored as a one-way hash, not as the token itself.
• A project is visible only to the person who created it; every action checks that first.
• The console sends strict browser security headers, and loads nothing from third parties except the payment checkout on its own payment page.

Webhooks

Webhooks from GitHub and from the payment provider are checked against their signature before anything in them is read, and each event is applied once, so a captured request can't be replayed.

Your app's own code

The free launch check looks for the mistakes that leak keys: a committed .env, a secret behind a NEXT_PUBLIC_ prefix, an unverified payment webhook, a database table without row-level security. It reads a public repository, keeps nothing, and never shows a key's value, only where it is.

What isn't done yet

Being straight about this is part of the point:

• No external penetration test yet. It's planned before a public launch.
• The encryption key lives in an environment variable, not a dedicated key store.
• Launchpad is in private beta; treat it accordingly for anything critical.

Report a vulnerability to security@axonscape.com. We'll acknowledge it within two working days.