This page is maintained by the Developer Sentinel team to answer common security, privacy, and operational questions about Developer Sentinel. It is editable project content, not an independent certification or third-party audit.
Developer Sentinel runs on Lovable Cloud (Supabase + Cloudflare). Some controls below are provided by that platform; others are implemented in our application. We describe capabilities that are enabled today — we do not promise certifications, regulatory compliance, or breach-free operation.
1. Account access & authentication
- Email/password and Google OAuth, brokered by our identity provider.
- Per-workspace role model (owner, admin, member) enforced server-side via row-level security.
- Session tokens are stored in the browser and validated on every privileged server call.
- Administrative actions (site pairing, role changes, AI key management) are limited to workspace owners and admins.
2. Platform & hosting
- Application runtime: Cloudflare Workers (edge), with stateless workers per request.
- Database, auth, and object storage: Lovable Cloud (Supabase). Data is encrypted in transit (TLS) and at rest by the provider.
- Backups and point-in-time recovery are provided by the database platform; we do not maintain our own off-platform copies.
3. Data we collect
- Account data: email, name, OAuth identifiers, workspace settings.
- Connector data: WordPress site URL, hashed pairing token, server-only call secret.
- Operational data: incidents, agent messages, tool-call logs, audit log, scan findings.
- Billing data: Stripe customer and subscription identifiers (no card data is stored by us).
See our Privacy Policy for the full statement on what we collect, why, and how long we keep it.
4. Secrets & sensitive fields
- WordPress pairing tokens are sent once to the connector and never stored in plaintext — we keep only a SHA-256 hash and a short prefix.
- WordPress call secrets (used for the connector's authenticated API calls) and the token hash are not exposed through the application's data API, even to workspace admins. They are read only by server-side code that performs the actual connector requests.
- Third-party AI API keys (OpenAI, Anthropic, Google) provided by workspace admins for "bring your own key" agent runs are stored per workspace and are not readable through the application's data API. The settings UI shows only masked previews (first three and last four characters); the raw key is used only at agent runtime, server-side.
- Stripe webhook signing secret and other infrastructure secrets are managed by the platform and never reach client code.
5. Workspace isolation
- Every domain table carries a
workspace_id. Row-level security restricts reads and writes to members of that workspace. - Privileged actions (site connect/disconnect, AI key management, billing) additionally require the owner or admin role.
- Server functions that bypass row-level security re-check workspace membership before returning sensitive data.
6. WordPress connector capabilities
- Sites start in read-only mode. Admin actions that modify a site require explicit promotion to action-enabled capability.
- The connector authenticates every request with a bearer call secret that can be rotated by unpairing and re-issuing a token.
- Agent-proposed actions are recorded server-side and require approval by an owner or admin before execution.
7. Storage & uploads
- Incident screenshots live in a private storage bucket scoped by workspace. Members can read and upload; only the original uploader can update or delete their own file.
- Public access is disabled — files are served via short-lived signed URLs.
8. Subprocessors & integrations
- Lovable Cloud / Supabase — database, auth, storage.
- Cloudflare — application runtime and edge delivery.
- Stripe — billing and payment processing.
- OpenAI, Anthropic, Google — only when the workspace admin provides their own API key for the AI agent. We do not relay these keys through our own AI gateway.
- WPScan vulnerability feed — used to enrich plugin/theme vulnerability data.
9. Logging & audit
- Privileged actions are recorded in a per-workspace audit log readable by owners and admins.
- Server functions that touch connectors record tool-call metadata for the incident timeline.
- We avoid logging raw secrets or full request bodies that contain credentials.
10. Vulnerability reporting
If you believe you have found a security issue in Developer Sentinel, please contact us at security@wpsentinel.dev. Please give us a reasonable window to investigate and remediate before public disclosure.
11. Compliance posture
Developer Sentinel is not currently certified against SOC 2, ISO 27001, HIPAA, or PCI DSS. The Lovable Cloud / Supabase platform provides its own compliance posture; please consult the platform's documentation for the most current details. We do not represent those certifications as our own.
12. Shared responsibility
- Platform (Lovable Cloud, Cloudflare): infrastructure security, network protection, encryption in transit and at rest.
- Developer Sentinel: application code, row-level security policies, role enforcement, connector design, audit logging.
- You: account hygiene (strong passwords / OAuth), workspace role assignments, deciding which sites to connect, choosing which AI provider keys to load, and reviewing agent-proposed actions before approval.
Questions about this page? Email security@wpsentinel.dev.