Security
Shadow Forge holds your tool library and your drawer designs. Here is how that is protected.
1. Architecture
The parts of Shadow Forge that generate geometry run entirely in your browser. Photographs are processed, tools traced, and DXF/STL/PDF written on your own machine. The server side exists to store your account and sync your library — not to do the work.
This is a deliberate design choice, and it is the strongest security property we have: data that is never transmitted cannot be intercepted, and data we never hold cannot be breached from us.
2. Data isolation
Our database enforces row-level security. Access rules are applied by the database itself on every query, so one account physically cannot read another account's rows — it does not depend on the application layer remembering to filter.
3. Encryption
All traffic is encrypted in transit with TLS. Data at rest is encrypted by our infrastructure provider.
4. Authentication
Passwords are hashed by our authentication provider — we never store or see them in plaintext, and we cannot recover one for you. Password reset runs through a signed, time-limited link sent to your email.
The publishable API key shipped in the client is public by design; it grants nothing on its own, because row-level security governs access. Privileged keys and payment secrets are held only in server-side function secrets and are never exposed to the browser.
5. Payments
Payments run through Stripe. Card details go from your browser to Stripe directly — they never pass through, and are never stored on, our servers. Checkout and every billing change — updating your card, canceling — happen on Stripe-hosted pages. We keep only Stripe's identifiers for your customer and subscription so we know which plan you are on; we do not store your card number, and we cannot see it.
6. Reporting a vulnerability
If you find a security issue, please tell us before you tell anyone else, and give us a reasonable window to fix it. Email support@shadowforge.tools with the details and steps to reproduce, and put Security in the subject so it reaches us quickly. We will acknowledge your report and keep you updated while we fix it if you would like.