Security

This page says how Terminal protects your account and the data it sends. It describes what the product does today.

Signing in

You can sign in with an email and password, or continue with Google or GitHub. A new password account confirms its email address with a link.

Terminal never stores your password. It stores a salted scrypt hash of it, and checks a sign-in against that hash. Sign-in, sign-up and reset requests are rate limited.

Resetting your password ends every session on the account. Confirming your email address ends every session opened before it was confirmed.

Sessions

A session is a random token in a cookie named terminal_session. The cookie is HttpOnly, so page scripts cannot read it. It is SameSite=Lax, and it is sent only over HTTPS when the site uses HTTPS.

The server stores only a SHA-256 hash of the session token. Signing out deletes the session on the server, not only in your browser. Each session expires after a fixed time.

Terminal refuses changes sent from other sites. A form post or API change whose origin is not Terminal is rejected. Pages load scripts only from Terminal's own site.

API keys

An API key is shown once, when you create it. Copy it then. Terminal stores only a SHA-256 hash of the key, so it cannot show the key again.

The API keys screen shows each key's start and its last four characters. Each key has scopes that limit what it can do. You can revoke a key at any time, and a revoked key stops working.

If you lose a key, revoke it and create a new one.

Signed webhooks

Signed webhooks are built and not open to everyone yet.

Each webhook request carries a Terminal-Signature header. It holds a time and an HMAC-SHA256 signature of that time and the exact body, made with your signing secret.

The signing secret is shown once, when you add the webhook. Check the signature on every request. Reject a request whose time is more than 300 seconds from your clock, and drop repeats by their id.

Terminal sends webhooks only to public internet addresses. It checks the address again on every send, and it does not follow redirects.

Your data

You can delete your account from Account. Deletion removes your sign-in, sessions, alert rules, watchlist and destinations. It cannot be undone. Past alerts stay without your name or email, so the public Scoreboard keeps its counts.

Payment records stay, with your personal details removed. Open unpaid invoices are canceled. There is no export button yet. To ask for a copy of your data, see delete your account or get a copy of your data.

Webhook addresses, signing secrets and the secrets you give a bot destination are stored encrypted. Terminal shows a signing secret once, when you create the destination.

Report a security problem

Send reports to the contact in our security.txt file. It is the same support email the security page names. Please include the steps to reproduce the problem.

Updated Nov 2, 2026