Security at SpecSprout
SpecSprout is designed so customer product data is private by default and server authorization decides which workspace a signed-in account may access. See the Trust Center for the broader ownership, provider and DPA picture.
Sessions use HttpOnly cookies, same-site protections and per-session CSRF tokens. Password changes and resets invalidate other active sessions. Security-sensitive account activity is recorded without intentionally storing raw IP addresses.
The browser cannot choose an arbitrary cloud workspace identifier. Cloud APIs derive the workspace from the verified server-side account session and namespace customer data under that workspace.
SpecSprout cloud workspace data and evidence are stored in Netlify Blobs. Netlify documents that Blobs are encrypted at rest and in transit, and documents TLS 1.2 or greater for traffic in transit. SpecSprout also sends HSTS on hosted responses. This is provider-managed encryption, not end-to-end encryption: server functions and configured processors must be able to process content when a requested feature requires it.
Netlify Blobs sensitive-data documentation ↗ · Netlify security overview ↗
Uploaded evidence is allow-listed by format, checked against its file signature and rejected when it contains executable signatures, Office macros/embedded objects, or active PDF content. Old binary Office formats and executable files are not accepted.
Descriptions and uploaded files are treated as untrusted evidence. Instructions embedded inside documents do not override SpecSprout's extraction rules, and AI requests are protected by authentication, CSRF checks, quotas, rate limits and abuse controls. The OpenAI API key remains server-side.
Card details are handled by Stripe-hosted payment surfaces. SpecSprout stores Stripe identifiers and billing state, not raw card data.
Report a vulnerability
Loading the configured security contact…
Please report suspected vulnerabilities privately rather than posting exploit details publicly. Include the affected URL, reproduction steps and impact. Do not access data that is not yours, degrade the service, or perform destructive testing.
Response targets
SpecSprout's operating target is to acknowledge credible reports within 3 business days, triage severity promptly, preserve relevant audit evidence, rotate exposed secrets where necessary, and notify affected users or authorities when legally required. This is an operational target, not a guaranteed SLA unless a separate contract says otherwise.