How HCode keeps your projects apart from other customers' projects, and how it stores the secrets, keys and tokens you give it.
Organisations and access
Every project belongs to one organisation. Each request you make is checked twice: the dashboard checks that you are a member of the project's organisation and that your role allows the action, and the platform behind it checks again that the project belongs to the organisation you're acting for.
A project, database or domain in another organisation answers as "not found", the same as one that doesn't exist, so its ID can't be used to learn that it's there.
Viewers can look but not change anything. Owners, admins and members can change projects, and some actions, such as deleting a project, are for owners and admins only. See Roles and permissions.
Network isolation
Each project gets its own private network:
- your app joins the project's network and the shared network that carries web traffic to it
- your project's databases join the project's network only
Another customer's app can't reach your databases, and their names don't resolve from it.
All apps share the network that carries web traffic, so another app can reach your app's web port the same way the internet can through its address. Treat your app's web port as public, and protect admin pages with a login rather than by keeping them unlisted.
Databases
Your databases can't be reached from the internet unless you turn on external access for them; it is off for every new database. With external access on, a client also needs an access token:
- a database can have at most 10 active tokens
- HCode stores only a hash of each token, so the connection string with a new token is shown once ("Copy this connection string now. You won't see it again.")
- turning external access off revokes every token straight away
See External access.
Secrets
These are encrypted before they are stored, with AES-256-GCM:
- environment variable values
- database passwords and connection strings
- the GitHub access HCode holds for your account
Environment variables explains how values reach your app.
Build logs
Your build log is scrubbed before it's stored or shown. The value of every build secret and every environment variable given to the build is replaced with [redacted:NAME], where NAME is the variable's name. Values shorter than 4 characters are left as they are, so don't rely on this for very short values. See Build logs.
API keys
API keys start with hc_. HCode stores a SHA-256 hash of each key, not the key, so the full key is shown once when you create it ("This secret is shown once. Store it securely before dismissing this message."). Keys expire after 90 days unless you choose another date, and no key can last longer than 365 days. See API keys.
Restores
Before a restore loads a backup, HCode checks the backup file against the checksum recorded when the backup was taken, and refuses a file that doesn't match. See Restore a backup.
Outgoing mail
Apps can't connect to mail servers on the SMTP, IMAP and POP ports, because their outgoing traffic leaves from addresses shared with other customers. See Sending email.
Reporting a security problem
If you find a security problem in HCode, email [email protected] with the details and how to reproduce it.