Skip to content

Security

Authentication

Atlas uses GitHub OAuth with httpOnly session cookies (HMAC-SHA256 JWT, 30-day expiry). Sessions are stored in the database and can be revoked. We never store passwords.

Data encryption

All data is transmitted over HTTPS. Session tokens are hashed before storage. API keys are stored as environment variables, never in code.

Infrastructure

Atlas runs on Vercel (serverless edge + isolated functions) with Turso (libSQL) for database. Both services provide built-in DDoS protection and encryption at rest.

Reporting vulnerabilities

Found a security issue? Please report it responsibly via GitHub Security Advisories. We will respond within 48 hours.