Security

Version 2026-08-31

How Skema is built and how to report a problem.

Reporting a vulnerability

Email contact@skema.world. Please include enough detail to reproduce the issue. We will acknowledge your report and keep you informed while we investigate. Please give us a reasonable opportunity to fix the problem before disclosing it publicly.

We will not pursue legal action over good-faith research that respects other customers' data and does not degrade the service.

How workspaces are separated

Each workspace has its own database. Which workspace a request belongs to is decided from the session, never from anything the caller supplies, so a workspace cannot be reached by changing a value in a URL or a request body.

Accounts and sessions

Passwords are stored hashed, never in plain text. The session cookie is HttpOnly and, over HTTPS, Secure. Requests that change state must carry a matching Origin header.

Transport

Traffic is served over HTTPS with a certificate that renews automatically. Plain HTTP is redirected.

Secrets

Credentials are held in a managed secret store and read into memory at start-up. They are not written to disk on the server and are not present in the source code.

What we do not claim

We hold no security certification and make no compliance claim. This page describes the controls that exist; it is not an audit.