Security

This page focuses on the parts most teams care about day to day: tokens, project visibility, and who can do what.

API tokens

Project API tokens are meant for CI, SDK uploads, and CLI automation.

Current behavior we verified:

tokens are project-scoped
token values are hashed for storage
tokens can expire
token usage is tracked

If you lose a token, create a new one. The plain value is not recoverable later.

User auth

For interactive usage, Vizzly supports normal user accounts and OAuth-based flows.

Passwords are hashed with bcrypt. Sensitive credential-like values such as OAuth-related secrets are encrypted before storage.

Project visibility

Projects can be private or public.

Private projects require normal access checks. Public projects can expose read-only build content more broadly, but write actions still depend on authentication and permissions.

There is also a project-level public-properties feature for selectively exposing screenshots based on metadata.

Permissions

In practice, the important distinction is:

user accounts can manage interactive features and settings
project API tokens are for project-scoped automation, not broad admin actions

That is why some actions work with a user login but not with a raw project token.

Transport and application security

The app validates tokens, rate-limits requests, and verifies webhook signatures. Cloud screenshots are also checked for supported formats, file size, dimensions, and whether the image can be decoded. See the screenshot requirements for those limits.

Security hygiene

store tokens in your CI secret manager
do not commit tokens to git
rotate unused or long-lived tokens
give public access only where you actually want it