How your data is handled

What this server stores, where, and what leaves it.

What is stored

• Accounts: name, email, the id of the linked Google account (through the account service), hashed session tokens and hashed API tokens. Accounts created before sign-in became Google-only also keep their salted scrypt password hash.
• Projects: name, description, repository URL, environments (including capture base URLs) and rules.
• Captures: sanitized API exchanges from HAR uploads or the capture worker — method, normalized endpoint, status, timing, allow-listed headers and redacted JSON bodies. The uploaded HAR file itself is discarded after parsing.
• Source: extracted source files from uploaded archives (only source-like files; the archive is deleted after extraction). Results keep only matched lines as snippets.
• Results: findings, redacted example bodies, reviews, notes and recorded test results.
• Workbench: journey instances (request configurations derived from a recording), their run results and documentation notes. Credentials you add to an instance are encrypted (AES-256-GCM) before they are stored, are masked on screen, and are left out of exports unless you choose to include them.

Everything is kept in one SQLite database and a source folder inside the server's data directory (NUXT_DATA_DIR).

Redaction before storage

• Only JSON API responses are kept; images, fonts, scripts, documents and known analytics hosts are dropped.
• Authorization, cookies, API keys, CSRF headers and any header that looks like a token are replaced with [REDACTED]; all other headers except a short allow-list are not stored.
• Token-like query parameters and configurable JSON paths (passwords, tokens, card numbers, emails, phone numbers…) are redacted. Types are preserved so structure can still be compared.

What leaves the server

• Nothing is sent to AI providers, analytics or other third parties. The app loads no third-party scripts or fonts.
• The optional capture worker visits only the base URLs of your environments, and only hosts on the operator's allow-list.
• When the operator enables it, requests you send from the API Explorer or run from a journey instance go only to the operator's allow-listed hosts. Responses are redacted like captures; only instance runs are stored (latest 20).
• Links to source files open your own repository host (GitHub/GitLab) only when you click them.

Deleting data

Deleting a capture, source upload, run or project removes it from the database (and its files from disk) immediately. Baselines are archived rather than deleted so history is not lost by accident; deleting the project removes them.