Security

Read-only by design

syncup requests read-only OAuth scopes from your Git provider. We can read commit history to write your scripts — we can never push, modify, or delete anything in your repositories.

Your code is never stored

We cache commit metadata (messages, hashes, file stats) to generate scripts, but we never store your source code. Diffs used for deep context are read in-memory at generation time and discarded immediately.

Credentials & encryption

• Provider access tokens are encrypted at rest with AES-256-GCM.
• Sessions use signed, httpOnly cookies — not accessible to JavaScript.
• All traffic is served over HTTPS.

Payments

Payments are handled by Lemon Squeezy, our Merchant of Record. Card details go directly to them — syncup never sees or stores your payment information.

Abuse prevention

We rate-limit sensitive endpoints, block disposable-email sign-ups, and limit account creation per network to keep the service safe and fair.

Responsible disclosure

Found a vulnerability? We'd genuinely like to hear from you. Email support [at] getsyncup.io with the details and steps to reproduce, and please give us a reasonable window to fix it before disclosing publicly.

A note on scope

We follow strong security practices, but no service is perfectly secure and this page isn't a formal certification. We're continually improving our posture.