Security
This page summarizes security practices for Revive. No product can promise perfect safety. See the Privacy Policy and Terms for legal terms.
What Revive implements
- HTTPS with HSTS on the public app
- Security headers (CSP, frame denial, nosniff, referrer policy, COOP)
- Supabase Auth for accounts; service-role keys never shipped to browsers
- Row Level Security so users primarily see their own data
- HMAC on internal control-plane / probe APIs where implemented
- Plan limits and multi-layer rate limiting (edge + client)
- SSRF-oriented URL checks for monitors and webhooks
- Blocked scanner paths for common secret probes
- Strong password requirements on signup (12+ with mixed classes)
- Open-redirect protection on post-login navigation
- Optional TOTP MFA when enrolled in Supabase Auth
What you should do as a user
- Use a unique, strong password (password manager recommended)
- Enable two-factor authentication in Profile when available
- Treat webhook URLs and auto-fix secrets like passwords
- Only monitor hosts you are allowed to probe
- Sign out on shared computers
- Rotate secrets if you suspect exposure
Report a vulnerability
Email support@getrevive.dev with enough detail to reproduce. Please avoid public disclosure until we can investigate.