Security

This page describes our team’s approach to protecting accounts, devices, infrastructure, and customer data, and explains how to report a security issue in Mailcoach.

Reporting a vulnerability

If you discover a security issue in Mailcoach, please email security@mailcoach.app.

Accounts and access

Our team guidelines require unique passwords stored in 1Password and two-factor authentication on every service that supports it, with passkeys or an authenticator preferred over SMS. SSH keys must be protected with a passphrase or kept in the 1Password SSH agent.

Internal tools must use Google login restricted to our Google Workspace domain. We prefer Google login for third-party services too. When someone leaves the team, our process is to suspend their Google Workspace account first and revoke their remaining access on the same day. Internal tools should use short sessions without a “remember me” option, because suspending an account does not end existing sessions.

Devices and development

Our device guidelines require FileVault on Macs, prompt operating system and browser updates, and locking screens when stepping away. Sensitive code and data must not be shared through publicly searchable services. We restrict browser extensions to trusted sources and avoid extensions that track keystrokes, passwords, or browsing history.

For development, our guidelines call for signed commits, protection of the main branch of live projects and packages, and secret scanning and push protection to catch leaked credentials. Our secure coding practices cover authentication, authorization, user input, file uploads, dependencies, and secrets.

AI tools

Our guidelines require team-managed accounts for AI coding tools. Secrets, customer data, and production database dumps must not be pasted into these tools, and production credentials must not be kept where a coding agent can read them. We treat integrations, skills, and plugins like dependencies and only install them from trusted sources.

Infrastructure and databases

Our infrastructure guidelines call for least-privilege access. On servers we manage ourselves, they specify supported software versions, automatic security updates, key-based SSH access rather than passwords, and firewalls that allow only relevant traffic. Server management through Forge or Ansible helps us apply patches and remove access.

Database guidelines call for a separate user per application with only the permissions it needs. Databases should not be publicly accessible: connections should be limited to application servers and, when needed, allowlisted IP addresses. Backups should be encrypted and their restoration checked regularly.

These are our team’s operational guidelines. If you self-host Mailcoach, you are responsible for securing and maintaining your own infrastructure, access, and backups.

Security incidents

Our incident guidelines treat security incidents as emergencies, including taking an application down when data is exposed. They call for rotating potentially compromised secrets, invalidating sessions and API tokens when accounts may be compromised, and preserving logs for investigation.

The team lead must be informed immediately. When personal data is involved, we assess reporting obligations, including whether a report to the data protection authority is required within 72 hours.

Privacy

For details about how we process personal data and how to exercise your rights, see our Privacy Policy.