Security
Every table has Row Level Security. Every file is encrypted at rest. Here's the detail behind that, and how to report a problem if you find one.
Every table in share.env has Row Level Security turned on. A hidden button in the interface is not a permission boundary. A policy is.
Postgres policies decide who can read or write a row before your application code ever runs, so a bug in the UI can't leak another team's secrets.
create policy "workspace_members_select"
on public.env_files for select
using (is_workspace_member(workspace_id, auth.uid()));File contents are encrypted in Supabase Storage. Nobody, including us, reads a .env file outside of an authorized request.
Links are generated with cryptographically secure tokens, always carry an expiry date, and can be revoked the moment access should end.
Every change to a file is recorded with who made it and when, so security reviews take minutes instead of days.
share.env runs on a small, named set of providers, each under a data processing agreement:
File contents are encrypted at rest in Supabase Storage. We don't log the contents of your .env files or access tokens in application logs, error trackers, or analytics.
share.env is an early-stage product. We haven't pursued SOC 2 or ISO 27001 certification yet, and we won't claim we have. What we do have is enforced from day one: database-level RLS, encryption at rest, and least-privilege use of service-role credentials. We'll update this page if that changes.
If you find a security issue, email kpzsproductionscontact@gmail.com with details and, if possible, steps to reproduce. We don't yet run a paid bug bounty program, but we will acknowledge reports, fix confirmed issues promptly, and credit reporters who want credit.
Please don't test against other users' data or workspaces you don't own; use your own account and environments.