BirdSafeDocumentation
Back to site
Browse docs
Documentation homeInstall and first backupBrowse, search, and organizeBackup, export, and restoreNotion syncMCP integrationAccount and billingTroubleshootingChangelogPrivacy policyTerms of serviceSecurity overview

Status: actively maintained

Security overview

BirdSafe's current trust boundaries, controls, known limitations, and responsible disclosure process.

Audit status

BirdSafe does not currently claim an independent third-party security audit or SOC 2 / ISO 27001 certification. This page is a transparency overview, not a third-party assurance report.

Architecture and trust boundaries

  • The library is local first and written to the browser database first
  • The BirdSafe API handles account, subscription, and necessary service state
  • Dodo Payments hosts payment; payment API keys are never shipped in the public frontend
  • Notion, MCP, and cloud media features run only after the user connects or enables them

Current controls

AreaControl
TransportProduction services use HTTPS
IdentityProtected interfaces require a session or dedicated Bearer Token
PaymentsCheckout is created server-side; verified webhooks update one subscription ledger
SecretsSensitive keys stay in server environments and are excluded from the public frontend
DataRecoverable JSON export; optional cloud features are off by default or require explicit authorization
ReleaseStatic checks, builds, and critical-page verification precede deployment

Known limitations

  • Local data security depends on your device, browser profile, and operating-system account
  • Third-party API, page, or access-rule changes can affect sync
  • Deleted source media may be unrecoverable if it was not cached in time
  • Logs and retention in a connected AI client are not controlled solely by BirdSafe

Report a security issue

Send a description, reproduction steps, impact, and redacted evidence to duynce@gmail.com. Do not access other users' data, run destructive tests, or publish an exploitable issue without authorization.

  • Never send passwords, complete payment details, or live tokens
  • Allow reasonable time for triage and repair
  • Follow third-party disclosure rules when their service is involved

Response process

  1. 1

    Acknowledge

    Confirm receipt and assess likely impact.

  2. 2

    Contain

    Rotate secrets, restrict a feature, or deploy temporary protection if needed.

  3. 3

    Remediate

    Fix code or configuration and verify critical paths.

  4. 4

    Review

    Record the root cause and preventive improvements, and update public guidance where appropriate.