Security
How Monstral isolates every sandbox, session, and dataset — and what we intentionally never collect.
Not found, not forbidden
Any sandbox, project, or report outside your account returns a plain 404, never a 403 — so no response ever confirms that something you can't access even exists.
Right-sized hashing
Buyer passwords go through slow, deliberately expensive hashing. Session and API keys are already high-entropy, so they use fast hashing built for verification, not brute-force resistance.
Rate limits that survive a restart
Failed-login counters live in the database, not in memory, so a crashed or redeployed process can't hand an attacker a free reset.
Whitelisted telemetry, not blacklisted
Sandbox analytics collect an explicit, reviewed list of fields. A newly added field stays invisible until someone deliberately allows it — the opposite of a blocklist that leaks by default.
No inline styles, no external calls
The embed runs under a strict Content Security Policy with no unsafe-inline and no external image or font requests, so it drops into a security-conscious buyer's site without a CSP exception.
Same door, every time
A wrong password and an unknown email produce the identical response and timing, so login attempts can't be used to enumerate real accounts.
One audit log, append-only
Every privileged action is recorded, and the log itself has no delete endpoint — a log you can edit isn't an audit trail.
Found a vulnerability, or need our security documentation for a review?
Contact security