Security
How your account and data are protected.
No passwords to steal
FabPulse accounts sign in with a one-time email link, not a password. There's nothing stored on our end that could be leaked and reused elsewhere, and no password to guess or brute force.
Payment data
Card and payment details are handled entirely by our payment processor (currently Stripe) — they never touch FabPulse's servers or database. We store a subscription status and a processor-issued customer ID, nothing else.
Infrastructure
- All traffic is served over HTTPS.
- The database (Supabase/Postgres) uses row-level security policies to separate what's publicly readable from what requires authentication — the underlying service credentials that bypass those policies are never exposed to the browser.
- Public write endpoints (newsletter signup, project alerts, checkout) are rate-limited to prevent abuse.
- Application hosting runs on Vercel; email delivery runs through Resend with domain-level sender authentication (SPF/DKIM).
API keys
API keys are tied to your account and can be regenerated anytime from My Account — regenerating immediately invalidates the previous key. Requests are rate-limited per key by plan tier.
Reporting a vulnerability
If you find a security issue, please report it to hello@getfabpulse.com rather than disclosing it publicly. We'll acknowledge and work on a fix as quickly as we can.