Your repositories and signing credentials are the keys to your apps. This page explains how NativeBlade protects them and how to report a security issue.
Infrastructure
- Hosting. The Website, the NativeBlade Cloud portal and its database run on Laravel Cloud.
- Builds. Builds run on build servers operated by NativeBlade, including macOS machines for Apple platforms. Build servers are not shared with other services, and are started on demand and stopped when idle.
- Storage. Build artifacts and Studio uploads are stored in private object storage and served through authorized downloads.
- Payments. Payments are handled by Stripe. Card data never passes through our servers.
Protecting your secrets
- Encryption in transit. Every connection between you and NativeBlade, including the portal, API and CLI, uses HTTPS.
- Encryption at rest. Signing credentials, certificates, private keys, keystores, environment variables, Google services files and two-factor authentication secrets are encrypted at the application layer with AES-256 before they are stored.
- API tokens. Tokens are shown to you once. We store only a SHA-256 hash, so a leaked database would not reveal them.
- Repository access. We access your code through the NativeBlade GitHub App, only for the repositories you select, using short-lived installation tokens.
- Webhooks. Every webhook delivery is signed with HMAC-SHA256 in the
X-NB-Signatureheader, so your server can verify it came from NativeBlade.
Data retention
- Builds, build logs and artifacts are deleted automatically after your plan's retention period, currently 7 days. A cleanup job runs every day.
- Your app's end users are never exposed to NativeBlade Cloud. The platform builds and signs your apps; it does not run inside them or collect data about the people who use them.
See our Privacy Policy for the full retention schedule.
Account security
- Email verification is required before using the Services.
- Two-factor authentication with an authenticator app (TOTP) is available for every account.
- New sign-in alerts are emailed to you when your account is accessed from a device we have not seen before.
- Device authorization lets the CLI and Studio connect to your account without ever handling your password.
- Team roles (Owner, Admin and Developer) let you control who can change projects, signing and billing.
Keep your authenticator app backed up. Losing access to it can lock you out of your account.
Your responsibilities
Security is shared. Please:
- enable two-factor authentication;
- give team members only the role they need, and remove people who leave;
- never commit secrets to your repository; use environment variables in NativeBlade instead;
- rotate API tokens, webhook secrets and signing credentials if you suspect they were exposed.
Reporting a vulnerability
If you find a security vulnerability in NativeBlade Cloud or the Website, email security@nativeblade.dev. Please include:
- a description of the issue and its impact;
- steps to reproduce it, or a proof of concept;
- the tools you used, with versions, and their output.
We will acknowledge your report, keep you updated while we investigate, and let you know when it is fixed.
Good-faith research. We will not pursue action against researchers who act in good faith: who report to us privately, avoid accessing or changing other users' data, avoid degrading the Services, and give us reasonable time to fix the issue before disclosing it publicly.
Please do not run automated scanners against production, attempt denial of service, or use social engineering against our team or users. We do not currently run a paid bug bounty program.