A developer laptop is stolen, unlocked.
No secret values are on it. The device token is revocable from the console, and any credential it held has already expired.
Security model
We assume the endpoint is hostile.
Shortspan is designed around one assumption: sooner or later, a laptop will be stolen, a token will leak, or an employee will leave badly. Every decision below follows from planning for that day instead of hoping it does not come.
Threat model
What we designed against.
A security model is only meaningful against a stated threat. These are the six we designed for, and the control that answers each.
Our database is exfiltrated in full.
Every secret is ciphertext. The master key that unwraps the per-secret data keys is held outside the database.
A production server is replaced by an impostor.
Host key fingerprints are pinned. A mismatch aborts the connection before any credential is transmitted, and files an incident.
An engineer leaves and keeps a copy of their keys.
There is no standing key to keep. Revoking the person ends their ability to obtain new credentials everywhere at once.
A CI token leaks into a public build log.
Tokens are project-scoped and revocable in one command, and the audit trail shows exactly what the token reached before you noticed.
Someone disputes what happened during an incident.
Append-only audit records name the actor, device, source IP, target, and outcome for every credential ever issued.
Cryptography
Envelope encryption, end to end.
Per-secret data keys wrapped by a per-organization master key. Standard constructions, no invented cryptography.
Arrival
A secret reaches us over TLS 1.2 or better and is never written to disk in plaintext at any point in the request.
Data key
A fresh 256-bit key encrypts the value with AES-256-GCM, producing ciphertext and an authentication tag that detects tampering.
Key wrapping
That data key is itself encrypted under your organization’s master key, so each secret has its own key and a compromise does not cascade.
Separation
The master key lives outside the database. A stolen database dump yields ciphertext and wrapped keys, and nothing else.
Retrieval
On an authorized read the data key is unwrapped in memory, the value is decrypted, returned over TLS, and the buffers are released.
What this does not protect against: an attacker holding both the database and the master key at once, or an administrator inside your own workspace who is authorized to read the secret. Encryption narrows the blast radius - access policy and the audit trail carry the rest.
Controls
Least privilege, actually enforced.
Roles, scopes, approvals, and isolation are checked on the server for every request - never assumed from what the interface happened to render.
Authentication
- Passkeys (WebAuthn) and TOTP two-factor authentication, with recovery codes.
- Passwords hashed with a memory-hard algorithm; never stored or logged in plaintext.
- CLI devices are individually named, individually revocable, and visible in an audit view.
- Session tokens are scoped to a device and expire; there is no permanent API key to leak.
Authorization
- Four roles - owner, admin, developer, viewer - enforced server-side on every request.
- Project-scoped tokens for services and CI, narrower than any human grant.
- Time-boxed access requests with explicit approval for anything privileged.
- Runbooks carry run-as users and command allowlists, so nobody needs an ad-hoc root shell.
Isolation
- Every query is scoped by organization; tenancy is enforced in the data layer, not in the UI.
- Separate encryption keys per organization, so a key compromise cannot cross a tenant boundary.
- UUID identifiers throughout - no sequential ids to enumerate.
- Rate limits on credential retrieval endpoints, per token and per organization.
Transport
- TLS 1.2 or better everywhere, with modern cipher suites only.
- The CLI verifies the server before it authenticates, not after.
- SSH host keys are pinned; a mismatch fails closed and files an incident.
- No credential is ever placed in a URL, a query string, or a log line.
Operations
How we run the thing.
Product security is only half of it. These are the practices behind the service itself.
Production access
Limited to a small on-call group, gated behind multi-factor authentication, logged, and reviewed. No shared administrative accounts.
Change management
Every change is peer-reviewed, passes static analysis and an automated test suite, and ships through a repeatable pipeline. Rollback is a first-class path.
Dependencies
Automated dependency and vulnerability scanning on every build. Critical advisories are patched within days, not release cycles.
Backups
Encrypted, rolling backups with periodic restoration tests. A backup you have never restored is a hypothesis, not a backup.
Monitoring
Availability, latency, and error-rate alerting with on-call rotation. Secret values are scrubbed from every trace and log line.
Incident response
A written runbook with defined severities, a named incident commander, and customer notification within the timeframes our DPA commits to.
Compliance
What we can prove today.
We would rather tell you exactly where we are than imply a certificate we do not hold.
In place now
- GDPR and UK GDPR alignment, with a Data Processing Addendum that takes effect automatically.
- Standard Contractual Clauses and the UK Addendum for international transfers.
- A published, current sub-processor list with 30 days’ notice before changes.
- A vulnerability disclosure policy with a safe harbour for good-faith research.
- Breach notification within 72 hours, contractually committed.
In progress
- SOC 2 Type II - controls mapped to the Trust Services Criteria, audit under way.
- ISO/IEC 27001 - gap assessment complete, certification planned to follow SOC 2.
- Regional data residency pinning for Enterprise workspaces.
- Self-hosted and air-gapped deployment for Enterprise.
Vendor questionnaires, architecture diagrams, and penetration test summaries go to security@shortspan.dev. We answer them ourselves.
Read the details, then try it against your own estate.
The free plan includes every security fundamental described on this page. Nothing here is gated behind a paid tier.
Found something? Our disclosure policy has a safe harbour and a one-business-day acknowledgement.