Security

• Unlock values are encrypted with AES-256-GCM before they are written to the database. A database dump alone cannot reveal plaintext values.
• After you save, browser APIs only ever see key names (for example “email”), never the values.
• Only the isolated study runner decrypts values in memory while exploring your product, using a separate runner token.
• Unlocks never appear in reports, exports, share links, or collaborator readouts.
• We do not claim zero-knowledge custody: the runner needs a server-held encryption key to unlock values during a study. That key is not stored in the database with your ciphertext.

• Finding screenshots and session media are stored as authenticated (not public) Cloudinary assets and delivered via short-lived signed URLs.
• Study reports and findings require project membership (or a revocable share link) to view — screenshots are not open CDN links.
• Shared readouts are sanitized: no explore-access values, no full staging URLs beyond a hostname label.

• Each study runs in an isolated Chromium environment with no shared browser state between customers.
• Runner ingest and dispatch use separate tokens with timing-safe verification.

Report security issues to security@litmusrun.com. We aim to acknowledge reports within two business days.