Security

1. Your scripts are never executed

ScriptPreflight reads script text as data. Our analysis engine only parses it and applies rules: nothing is run, evaluated or imported. We never connect to your environment, so we have no access to your cloud subscriptions, directories, servers, databases or hypervisors.

2. Secrets are redacted twice

Common secret patterns (tokens, keys, connection strings, and passwords in parameters, variables and net user commands) are redacted in your browser before upload, and again on our server before analysis. Both use the same redaction code, and a test fails if the two copies differ. Unusual formats can slip through, so don’t paste live credentials.

3. Temporary by default

The redacted text of a preflight is held only while the preflight runs. It is deleted when the preflight finishes, and a clean-up job deletes anything left over within about 30 minutes. Reports keep the flagged lines as evidence, not the whole script.

4. Saved scripts are encrypted per version

• Saving scripts needs a paid plan. Before a version is stored, it is redacted again on our server.
• Each version is encrypted with its own random 256-bit key (AES-256-GCM).
• That key is wrapped by a key held in Azure Key Vault; the wrapping key never leaves Key Vault. We store only the encrypted script and the wrapped key.
• The encryption is bound to the workspace, script and version, so a copied record can’t be decrypted anywhere else.

5. Workspace isolation

Every report, script and usage record belongs to one workspace. Row-level security is switched on for every table the app can reach, so the database itself stops one workspace from reading another’s data, and a test fails if a table is added without it. Server-only tables, such as the temporary script text, have no client access at all.

6. No script content in logs

Our server functions can only log a fixed list of fields: record IDs, processing states, timings, error codes and attempt counts. Scripts, reports, findings, email addresses and secrets cannot be logged.

7. No AI provider

AI features are switched off. Reports come from deterministic rules only, and no AI provider receives your scripts. Your scripts are not used to train AI models.

8. Retention

Trial reports are kept for 7 days and paid reports for the history period of your plan. Every retention period, and where each provider processes data, is in our privacy notice.

9. Reporting a vulnerability

Email security@scriptpreflight.com with what you found, how to reproduce it and the pages or endpoints involved. Please don’t access other people’s data, and give us a reasonable time to fix the issue before you share it. We will acknowledge your report and keep you informed while we investigate.

Our contact details for security researchers are also published at /.well-known/security.txt.