In transit
All traffic is served over TLS, with HSTS (includeSubDomains; preload) and a strict
Content-Security-Policy. Plaintext HTTP is redirected to HTTPS.
API keys
- Keys are returned in plaintext once at creation and never again.
- At rest we store only a salted, peppered HMAC-SHA256 hash. The raw key is never persisted and
cannot be recovered by anyone, including staff.
- Responses that carry key material are sent with
Cache-Control: no-store.
- Revocation is immediate.
Treat keys like passwords. Store them in a secret manager, use them server-side only, and never
commit them to source control. Rotate immediately if a key is exposed.
Your content
Prompts and diagrams are yours. Public API responses are scoped to your account, so you can only
read and modify resources you own.
Reporting a vulnerability
Found a security issue? Email security@diagrams.so with steps to reproduce. We appreciate
responsible disclosure and will respond promptly. A security.txt is published on our domains.
