Security

1. Scope

This page summarises technical controls implemented in the Orbilyn product. It is not a certification or marketing claim.

2. Controls in the product

From the current codebase:

• Integration credentials encrypted at rest with AES-256-GCM.
• Database row-level security (RLS) on user-scoped tables.
• API, MCP, and OAuth secrets stored as hashes (not plaintext tokens).
• SSRF protections for outbound integration hosts and webhook delivery.
• Rate limiting on sensitive HTTP endpoints.
• HTTPS with HSTS and a Content-Security-Policy applied in middleware.

3. Vulnerability reports

Report security issues privately to hello@orbilyn.com. Do not open a public issue first. See also /.well-known/security.txt.