Control framework
Application controls are organized around the OWASP Application Security Verification Standard. Secure-development practices use the NIST Secure Software Development Framework as a baseline for protecting source, producing well-secured releases, and responding to vulnerabilities. These references guide the control program and do not represent a certification.
Identity and access
- Accounts use verified email and time-based one-time password MFA, with controlled recovery and session revocation.
- Organization roles and app-level grants prevent members or clients from viewing unassigned apps.
- GitHub access uses a GitHub App with minimum required permissions and repository-by-repository selection.
- Firebase connections use the narrowest practical permissions and never grant access to unrelated projects.
- Workspace ownership is immutable, and material permission changes are auditable events.
Data protection
- Transport encryption is required for browser, API, webhook, and provider traffic.
- Provider credentials and sensitive configuration are encrypted and excluded from application logs.
- Customer and environment identifiers are checked at every authorization boundary.
- Production access is limited, logged, and used only for operational need.
- Backup configuration and bounded restoration tests are verified separately from whole-service recovery. Full recovery and deletion acceptance remain release requirements; a successful backup alone is not proof of recoverability.
Environment and application protection
Staging and production use separate Firebase projects, credentials, configuration, and deployment targets. Firebase Authentication protects user identity, while Firebase App Check provides an additional attestation layer for supported application and API traffic. Code changes are reviewed and checked for secrets, vulnerable dependencies, insecure patterns, and supply-chain risk before release.
Safe monitoring boundaries
Scheduled checks operate only on resources explicitly connected by an authorized user. Public application checks are passive and non-destructive. securePilot does not perform exploit attempts, credential attacks, denial-of-service testing, or scans against unapproved assets.
AI assistance and MCP access
Fix with AI prepares a redacted prompt that you can copy into your chosen coding assistant. Preparing or copying this prompt does not itself send source code to an AI provider. Review the copied content before sharing it; your chosen provider’s policies apply to information you send.
Where AI connections are enabled, MCP access uses scoped authentication and explicit workspace consent. Tools enforce their required scopes and your current workspace and app permissions, with rate limits and audit records. Connecting an assistant does not grant platform administrator access or permission to other customers’ workspaces.
Manage connected assistants in Settings → AI connections. Disconnecting stops new access; work already dispatched may finish. Recording a remediation explanation or changing a finding status does not replace scanner verification.
Report a vulnerability
Email hello@nocodeminute.com with “securePilot security report” in the subject. Include the affected URL or component, reproducible steps, and impact. Do not access other users’ data, disrupt service, or include live credentials. We will acknowledge the report and coordinate remediation and disclosure.
There is no public bug-bounty program at this time.