Security

Version 2026-09-29

How Skema is built and how to report a problem.

Reporting a vulnerability

Email contact@skema.world. Please include enough detail to reproduce the issue. We will acknowledge your report and keep you informed while we investigate. Please give us a reasonable opportunity to fix the problem before disclosing it publicly.

We will not pursue legal action over good-faith research that respects other customers' data and does not degrade the service.

How workspaces are separated

Each workspace has its own database. Which workspace a request belongs to is decided from the session, never from anything the caller supplies, so a workspace cannot be reached by changing a value in a URL or a request body.

Accounts and sessions

Passwords are stored hashed, never in plain text. Two-step sign-in is available, by authenticator app or by email code. Repeated failed sign-ins are limited. The session cookie is HttpOnly and, over HTTPS, Secure, and a session ends after 12 hours. Requests that change state must carry a matching Origin header.

What runs in your browser

The product loads its scripts, styles and fonts only from Skema itself; a content security policy refuses anything else. There are no third-party scripts on any page.

Transport

Traffic is served over HTTPS with a certificate that renews automatically. Plain HTTP is redirected.

Secrets

Credentials are held in a managed secret store and read into memory at start-up. They are not written to disk on the server and are not present in the source code. Model requests on skema.world use the server’s own cloud identity, so there is no model API key to leak.

Records

Every applied change is written to a signed, append-only chain. Sign-in outcomes, refused requests, permission changes and every view of the operator console are recorded with who, when and from which network address.

Backups

Backups are copied off the server to Google Cloud Storage, and restores are rehearsed with the result recorded. Skema runs on one server in one region, so a regional outage would stop the service until it is rebuilt.

Access by the people who run Skema

The operator console cannot display workspace content. The people who operate the servers can technically read workspace data; when that access is needed it is time-limited and recorded with its reason and approval, as the Privacy Policy describes.

What we do not claim

We hold no security certification and make no compliance claim. This page describes the controls that exist; it is not an audit.