Security

Aurora is designed to keep your projects safe. Every project runs in its own environment, access is verified on every request, and sensitive data is encrypted.

​

Isolated Containers

Each project runs in its own container with a separate filesystem, network, and process space. Your project cannot see or interact with any other project on the platform, even other projects on your own account.

​

Access Control

Only you and the collaborators you explicitly invite can access your project while you build. Every file operation, chat message, and preview request is checked against your permissions before it runs. Your project becomes publicly visible only when you choose to share a link, publish it to the community, or deploy it.

​

Encrypted at Rest

Secrets, environment variables, and connection credentials are encrypted before they are stored. They are only decrypted server-side when your container starts and are never visible in the browser.

​

Secure Previews

Live previews are protected by signed session tokens. Only authenticated users with access to the project can view the preview. Share links use tokens that you can revoke at any time.

​

Connected Database Protection

When you connect your own Supabase database, Aurora restricts operations to your project’s data. System tables, authentication schemas, and administrative operations are off-limits to prevent accidental changes to your database infrastructure.

​

Monitored and Rate Limited

All API endpoints are rate limited to prevent abuse. Authentication, chat, and file operations are monitored and throttled per user. Repeated failed requests trigger automatic cooldowns.

​

Responsible Disclosure

If you discover a security issue, please contact security@aurora.build. We take all reports seriously and will respond promptly.