Security

How Lattent protects your data, accounts and payments. Questions are welcome through the Contact link at the foot of every page. To report a vulnerability, first ask there for a private channel, and do not post details publicly.

Your data

• Analyses run locally in your browser. Without an account, nothing you enter leaves your computer.
• Cloud projects are stored in a Postgres database where row-level security is enforced by the database itself: every query runs as you, and only rows you own, or that your lab shares with you, are visible. The website holds no privileged keys.
• Storage quotas, project size, version numbers and ownership are set by the server, not by the browser, so they cannot be tampered with.
• Saving uses optimistic concurrency: if a project changed elsewhere, you are asked before anything is overwritten.
• Projects opened from the cloud or from files are validated and every value is escaped before display, so a shared project cannot run code in your browser.

Accounts

• Passwordless sign-in with one-time email links (PKCE flow); there are no passwords to leak.
• Sessions use short-lived tokens with refresh-token rotation.
• You can export all your data or permanently delete your account from the account page at any time.

Payments

• Card payments are handled entirely by Lemon Squeezy, a PCI-DSS compliant merchant of record. Lattent never sees or stores card numbers.
• Plans change only through webhooks signed with a shared secret (HMAC-SHA256, compared in constant time). Unsigned, replayed or out-of-order events are rejected, so a plan cannot be granted from the browser.
• Refunds and expired subscriptions remove access automatically.

The website

• Served over HTTPS with a strict Content-Security-Policy: scripts only from Lattent itself and one pinned library verified by Subresource Integrity.
• No analytics, advertising or tracking scripts.

Verification

Every release runs automated security tests that attack the database rules as different users (reading, editing or deleting others' projects, granting plans, bypassing quotas, joining other labs) and replay forged and duplicated payment events. All must pass before deployment. The code is public on GitHub.