Security

How Contrast protects access to your projects and handles project secrets.

Signing in

Contrast supports email sign-in links, GitHub sign-in, and passkeys. Production browser sessions use secure cookies scoped to the site that issued them.

Encrypted connections

Your connection to contrast.dev uses HTTPS, which encrypts data in transit.

Project access

Project file access and downloads check your identity and project membership on the server. Project roles control who can read, edit, and manage a project. Review who you invite and which previews or deployments you share publicly.

Project secrets

Values saved through project secret settings are encrypted before storage using AES-256-GCM. Contrast decrypts them when supplying them to the configured runtime. Values marked client-public are available to your app's client code. Keep private credentials in server secrets and out of source files and prompts.

Questions and security reports

Use our support contact to report a suspected vulnerability or ask a security question. Include the affected URL and steps to reproduce, without passwords, tokens, or other people's data.

See Data export for what you can download today and our Privacy Policy for information about personal data.