Security Policy

Security is built into how TheDevs stores and handles your data. This page explains the controls we use and how to report a security issue. It should be read with our Privacy Policy and Cookie Policy.

Password security

We never store passwords in plaintext. Passwords are hashed with bcrypt using a strong work factor, so even our database cannot reveal your password. When you set or change a password, it is hashed before it leaves our authentication flow.

Authentication

After sign in, your session is kept in a signed JWT (JSON Web Token). Tokens are signed with a server secret and verified on every request, so they cannot be tampered with. All authentication traffic runs over HTTPS/TLS, so credentials are encrypted in transit and never sent in the clear.

Token storage on clients

On our client apps, tokens are stored in the operating system’s secure storage — not in plain files or browser localStorage:

• iOS / macOS: stored in the macOS Keychain.
• Android: stored in the Android Keystore using EncryptedSharedPreferences.
• Windows: stored using Windows DPAPI.

This keeps tokens protected by the device’s own security hardware and OS-level encryption.

Data encryption

All network traffic is encrypted with TLS in transit. Sensitive data at rest is encrypted on our infrastructure. Backups are protected and access is restricted to the team members who need it.

Infrastructure security

Our hosting runs on reputable cloud providers with patching, monitoring, and access controls. We follow least-privilege access, keep software dependencies updated, and use CI/CD pipelines that build from reviewed code.

Reporting a vulnerability

If you believe you have found a security vulnerability in TheDevs, please report it responsibly to contact@thedevs.org. Please do not publicly disclose the issue until we have had time to investigate and fix it. We acknowledge reports within 3 business days and work with you on a fix and disclosure timeline.

Your part

Use a strong, unique password for your TheDevs account and keep your device secure. You can delete your account and data at any time per our Data Deletion Policy.