Security you can check, not just take on faith.

ZipLoom exists to catch the security gaps in AI-generated apps. We hold our own product to the same standard. Here's how your code, secrets, and deploys are handled.

What we check before your app is live

Every deploy passes through a security gate. The checks that run:

• Row-level security enforced on your database tables
• Secrets & exposed-credential detection across code and config
• Vulnerable-dependency (CVE) audit against the NVD
• Open-source license compliance
• Authentication configuration audit (JWT expiry, session rotation, CORS)
• Security-header audit (CSP, HSTS, cookie flags)
• TLS & certificate monitoring
• DNS, email-auth & subdomain-takeover checks

How your code and secrets are handled

Your environment variables and platform tokens are stored in an encrypted vault (AES-256), never in plaintext. Access to your data is scoped to your organization, and every account uses role-based access control — Owner, Admin, and Member — enforced at both the interface and the API. Create, update, and delete actions are written to an audit log.

Infrastructure

ZipLoom runs on Cloudflare's edge network with a web application firewall in front of it, backed by a Postgres database on Supabase with row-level security. Your app is deployed to the platform you choose; ZipLoom holds the deploy credentials in the encrypted vault and uses them only to ship and monitor your releases.

Sub-processors

Report a vulnerability

Found something? We want to hear about it. See our security policy for how to report, or email the security team.