Security at Did Anything Break?
A plain-language overview of how the service is designed to protect accounts and monitoring data.
Last updated: November 4, 2026Authentication
Accounts support Google OAuth, email/password authentication and a one-time email-link fallback. Application sessions use secure, HttpOnly cookies for DAB account access.
Private-by-default account data
Monitoring account tables use Row Level Security and are accessed by trusted backend services rather than exposed directly to anonymous browser clients.
Network protections
Website, API and webhook features validate destinations and block private, local and internal network addresses. Redirect targets are revalidated to reduce server-side request forgery risk.
Payments
Subscription checkout is handled by Stripe. Did Anything Break? does not need to receive or store your full payment card details.
Secrets
Do not place passwords, private tokens or other secrets into ordinary URL, expected-text or API-body fields. Features that accept webhook URLs are treated as sensitive configuration and are not returned through public status endpoints.
Report a security issue
If you believe you found a vulnerability, use the support page and clearly mark the message as a security report. Please avoid accessing data that does not belong to you.