Trust center
Earned, then published.
Everything we claim, with the evidence beside it. How we handle your access and your code is on the Process page.
Backed by Atarus
An Atarus Security company.
Atarus Security is an offensive security firm. It does penetration testing, red team work, and cloud and identity security. It serves organizations across the country, including critical infrastructure, local government and regulated industries.
Unflatline applies that discipline to software revival. Every engagement is tested the way Atarus tests client systems. Ship Safe reviews follow the same standard.
Certifications belong to Atarus team members. Individual attribution is shared with clients under NDA on request.
Research
Atarus publishes what it finds.
Atarus publishes what it learns. These four shaped how we treat stalled and AI-built software.
The Unflatline secure coding standard
Twelve rules. Every project, including our own.
This is the written standard each engagement follows. We publish it so you can hold us to it.
- R-01
Least privilege everywhere
Every person, service and API key gets the minimum access needed, scoped to one project and removed when the work ends. We ask for roles, not owner accounts.
- R-02
Secrets never live in code
Keys live in a secrets manager or the platform's encrypted settings, never in the repo, client bundle or chat. Anything found exposed is rotated immediately.
- R-03
Database access is deny-by-default
On Supabase and similar platforms we enable row-level security on every table, write explicit policies and test them with a non-admin user. Service-role keys stay on the server.
- R-04
Validate input, encode output
Every request is checked on the server for type, size and allowed values. Queries are parameterized. Output is escaped for the context it lands in.
- R-05
Authentication is not home-grown
We use proven providers and libraries, enforce strong session handling and offer multi-factor authentication where the data warrants it.
- R-06
Dependencies are scanned and kept small
Lockfiles are committed, packages are scanned for known vulnerabilities on every change and unused ones are removed. Updates are reviewed, not merged blindly.
- R-07
Security headers and HTTPS by default
A strict Content Security Policy, HSTS and the standard hardening headers, verified with automated checks.
- R-08
Reviewed changes
No code reaches production without a second look at the diff. Auth, payments and data access get explicit review.
- R-09
Safe error handling and logging
Users see generic errors. Detail goes to logs. Logs never contain passwords, tokens or unnecessary personal data.
- R-10
Backups and recovery tested
We confirm data can be restored before we change anything that holds it. We never run destructive operations on production without a verified backup.
- R-11
Minimal data collection
We collect only what the app needs, avoid third-party trackers and define how long data is kept.
- R-12
A security report on every delivery
What we checked, found, fixed and left open, described plainly, including what we did not fix.
How this site is built
We hold the site to the same standard.
- No analytics or tracking scripts, and no cookies of our own.
- A strict Content Security Policy and HSTS on every page.
- Every form is validated on the server. Bots are screened with a honeypot and a timing check, with no third-party trackers.
- IP addresses are stored only as salted, one-way hashes, for spam prevention.
- A security.txt is published at /.well-known/security.txt.
Responsible disclosure
Found something? Tell us.
Email security@unflatline.com with what you found, how to reproduce it and how to reach you. We acknowledge reports within 3 business days.
Please give us reasonable time to fix an issue before you disclose it. Do not access other people's data or disrupt the service. We will not pursue legal action over good-faith research that follows these rules. There is no paid bounty program yet.
Data retention, in short
How long we keep things.
| Data | Retention |
|---|---|
| Intake form submissions | 24 months after submission |
| Project code and working copies | Deleted when the fix window ends (14 days after a Sprint handover) |
| Invoices and accounting records | As long as the law requires |
| Waitlist emails | Until you unsubscribe |