Rustine

Security

Last updated

Rustine sees the flaws in your sites and can read your code: we have to protect that at least as well as we ask you to protect yours. Here is what is actually done, and how to report a flaw in Rustine itself.

Report a flaw

Write to security@rustine.io, in English or French. The rules are below, under Disclosure policy. Also in our security.txt.

Where your data lives

  • The app, the API, the database and the cache run on a dedicated server at Hetzner, in Helsinki (Finland). The database and the cache are only reachable from the server's private network, never from the internet.
  • The server only accepts web connections (HTTPS, and HTTP redirected to HTTPS) and SSH with a key, no password.
  • The providers that touch your data, and where they are, are listed in the privacy policy.

Scans, in isolated containers

  • Each scan runs in its own container on Google Cloud Run, in Paris, destroyed when the scan ends. No disk is shared between two scans.
  • The container only gets a token valid for its own scan, for 17 minutes at most. It never talks to the database: it sends its report to the API, which checks it before saving it.
  • Its network only goes out to ports 80 and 443 of public addresses; private networks are closed to it and nothing can reach it from outside. It leaves through a fixed address, published on The scanner page.

The secrets we find

When a scan finds a key or a password lying around, it masks it before sending it to us: we only keep its type, its last 4 characters (if it has at least 16) and a short fingerprint, enough to recognise it without being able to use it. So it never exists in clear on our side, neither in the database nor in the PDF reports. The same masking applies to code excerpts from a repository, and to what we send to the AI model that writes a Fix.

Your GitHub code

  • Rustine connects through a read-only GitHub App (repository contents and metadata): it cannot write anything to your repositories.
  • Each analysis asks GitHub for a token limited to a single repository, read-only, that expires within an hour, and revokes it as soon as the analysis is over. That token is never saved.
  • Before each analysis, Rustine checks that the person who added the repository still has access to it on GitHub (for repositories added since 15 October 2026): someone who leaves your organisation no longer gets anything of your code.
  • The copy of the repository is deleted when the analysis ends: we don't keep your code, only the problems found, with masked excerpts.

Your account

  • No password at Rustine: you sign in with a code sent by email (6 digits, valid 10 minutes, 5 attempts), or with Google or GitHub.
  • Two-factor authentication is required for everyone before the first sensitive action (proving a site, connecting GitHub, paying, creating an API key, connecting an agent), then at every sign-in: an authenticator app or a passkey, and ten recovery codes.
  • The session cookie can't be read by the page's scripts, only travels over HTTPS and expires after 7 days. Forms are protected against forged requests (CSRF), and sign-in attempts are rate-limited.
  • Each sign-in is written to a security log (method, date, a fingerprint of the network, never the IP address in clear), kept for a year.

What is encrypted or hashed

  • Encrypted (AES-256-GCM): your authenticator app's secret, the tokens that connect Supabase and the verification tokens of your sites.
  • Hashed, never kept in clear: API keys, the tokens of connected agents (OAuth), recovery codes and sign-in codes. An API key is shown once, when it is created.
  • Payment goes through Stripe: your card number never reaches us (we only keep the brand and the last 4 digits, to show them to you).

Our own access

  • The back office requires an administrator account and two-factor authentication.
  • Every administrative action (gifting credits, changing a plan, resetting two-factor authentication, deleting an account, stopping a scan…) is written to a log, with who did it and why. The database refuses any change to that log, and any deletion before 5 years.
  • Error reports from the app and the API go to our own error tracker, hosted in Germany, without cookies, request headers or the user's identity.

Backups

The database is copied every night to Cloudflare R2 storage located in the European Union, reserved for Rustine and reachable with a key limited to that space only. The last 14 copies are kept. A full restore was tested on 13 October 2026.

  • No active test without proof that the site is yours: a DNS record, a file or a tag on the site. The proof is checked again before every audit; without it, only the quick, passive scan is possible.
  • The scanner reads without changing anything: GET, HEAD and OPTIONS requests only, no form submitted, no exploit payload. A known vulnerability is detected from its version number, never by triggering it.
  • Each scan has a budget of requests and time. Its identifier and address are published on The scanner page.
  • A site can ask not to be scanned any more: abuse@rustine.io.

Disclosure policy

Found a flaw in Rustine (rustine.io, app.rustine.io, api.rustine.io, mcp.rustine.io, docs.rustine.io, or the scanner itself, for instance a way to make it scan a site without proof)? Please write to security@rustine.io: what is affected, how to reproduce it, and what an attacker could do with it.

What we commit to

  • Acknowledge your report within 72 hours, then keep you posted until it is fixed.
  • Fix according to severity: a critical flaw within 7 days, high within 30 days, medium within 90 days; a low one with an upcoming update.
  • Credit you, if you wish, once the flaw is fixed.
  • Not file a complaint nor take legal action against good-faith research that follows the rules below.

The rules

  • Test only with your own account, on sites you are allowed to scan.
  • Don't view, change or take away another user's data. If you come across some, stop there and tell us.
  • No denial of service, no load testing, no spam, no social engineering or phishing of our team.
  • Don't test our providers (Stripe, GitHub, Google, Cloudflare, Hetzner…): their flaws are reported to them.
  • Keep the flaw to yourself until it is fixed, or 90 days after your report if we did not keep to our timelines.

No cash bounty for now. In France, you can also report a flaw in good faith to ANSSI, the national cybersecurity agency, which keeps your identity confidential (article L2321-4 of the Defence Code).

Service status

Are the website, the app, the API, the MCP server and the docs answering? See the Service status page.