Current Security Measures

What's protecting your code right now

Client-Side Execution

All code runs locally in WebContainer, directly in your browser. Your files never touch our servers.

Active

AES-256 Encryption

API keys are encrypted with industry-standard AES-256 before storage. Only you can decrypt them.

Active

Two-Factor Authentication

Optional second login step via an authenticator app (TOTP) or an emailed code, with one-time backup codes. Enable it any time in Settings → Account.

Available

Row-Level Security

Every Supabase backend we generate for you has row-level security enabled by default, so your users' data stays isolated from each other.

Active

HTTPS Only

All connections are encrypted with TLS. Your data is protected in transit at all times.

Active

Encrypted At Rest

We store your chat history and generated project data so you can pick up where you left off, everything is encrypted with AES-256 before it ever touches the database.

Active

Sandboxed Environment

WebContainer provides complete isolation. Your code can't access anything outside its sandbox.

Active

Security Audit Completed

May 2026

Forge Lab Brain underwent a comprehensive security audit in May 2026 prior to open beta launch. All identified findings were fully remediated. The audit covered the following areas:

  • Authentication & session management
  • Input validation & output encoding
  • Access control & authorization
  • API security & rate limiting
  • Secret & credential management
  • HTTP security headers & transport security
  • File upload & data handling

What's Next

We're continuously improving our security posture. The following is on our roadmap.

Security Roadmap

  • Third-party penetration test by an independent security firm
  • SOC 2 Type II compliance certification
  • Bug bounty program for responsible disclosure
  • Detailed threat model and architecture security documentation
Report a Vulnerability