Security

1. Protecting your account

Your password and session are protected with standard industry practices:

• ✓ Argon2id password hashing (memory-hard, resistant to GPU brute-forcing) — we never store plain-text passwords
• ✓ Sessions via signed cookies, HttpOnly, with the Secure flag in production
• ✓ Panel traffic always served over HTTPS/TLS

2. Secrets and credentials

Keys and secrets used to integrate with third parties (Stripe, Resend) are never exposed to the client. Sensitive secrets are encrypted at rest in the database.

• ✓ Third-party credentials stay server-side only, never in the browser
• ✓ Secret rotation available on demand in case of suspected leakage

3. Isolation between beway.io and Hub

Hub runs entirely on the customer's own infrastructure. beway.io never accesses the containers, code, or data of the hosted applications — the only communication channel is the licensing API, which receives only the aggregate domain count.

4. Licensing API authentication

Every call from your Hub instance to beway.io is signed with HMAC-SHA256 and scoped to the current day, preventing replay of old requests. Full details in our Create domains.

5. beway.io infrastructure

Our infrastructure runs with regular database backups, uptime monitoring, and administrative access restricted through our own authentication — we never reuse customer credentials for internal access.

6. Recommended best practices

To keep your Hub instance secure, we recommend:

• • Using strong, unique secrets for JWT_SECRET and CREDENTIALS_ENCRYPTION_KEY
• • Scoping each API key to the minimum necessary (domains and permissions)
• • Keeping Hub updated to the latest published image version

7. Reporting a vulnerability

Found a security issue? We appreciate responsible disclosure — please send the details to [email protected]