Security
Last updated July 27, 2026
Draft. This is a working draft, not the final version. It is shared for transparency during the alpha and may change before launch.
Security is foundational to a developer platform. Here is how Flagon protects accounts and data, and how to reach us with a concern.
Accounts and credentials
- Passwords are stored only as salted hashes, never in plain text.
- Access tokens (personal and organization) are shown once and stored only as hashes; you can revoke any token at any time.
- You can review your active sessions and sign out of other devices from your security settings.
Data and tenancy
- Data is scoped to your organization, and access is governed by member roles.
- Data is encrypted in transit (TLS).
- Flagon is source-available and self-hostable: you can run it on your own infrastructure and keep data entirely under your control.
Reporting a vulnerability
If you believe you have found a security vulnerability, please report it privately to security@flagon.iorather than opening a public issue. Include enough detail to reproduce it. We will acknowledge your report, investigate, and keep you updated. We appreciate responsible disclosure and will not pursue action against good-faith research that respects our users' privacy and data.
Scope
Flagon is under active development during its alpha. Practices on this page describe the hosted service and will evolve; material changes will be reflected here.