security
Security at Shotlane
Shotlane opens arbitrary web pages for other people, so isolation is the core of the design: every page runs in a fresh sandboxed browser that can only reach the public internet, and nothing you send to log in is kept.
Isolated rendering
- Every render gets a fresh browser context: no cookies, storage or cache shared between requests or customers.
- Chromium runs with its own sandbox enabled (namespaces and seccomp) under an AppArmor profile; if the sandbox ever fails to start, it alerts us instead of carrying on quietly.
- The renderer runs as an unprivileged system user with a read-only system, private
/tmp, no home directories and no new privileges. - Hard limits per render: 90 seconds, memory caps per page, and full-page captures cut at 32,000 pixels.
Network boundaries
- A kernel firewall stops the browser from reaching private, link-local and cloud-metadata addresses and the server itself.
- Every request the page makes, including redirects and subresources, is checked again before it leaves.
- Custom
headers,cookiesandbasic_authare sent only to the target's own host, never to third-party resources on the page. - Webhooks go only to public https URLs and don't follow redirects.
Keys and access
- API keys can be rotated on the dashboard; the old key stops working at once, including for connected MCP clients.
- Public pages use signed URLs (HMAC-SHA256) bound to one endpoint, so your secret key never appears in HTML.
- MCP clients sign in with OAuth 2.1 and PKCE; you approve each app and can revoke it on the dashboard.
- Webhooks are signed (
X-Shotlane-Signature) so you can verify they came from us.
Your data
- Credentials you send for a render (cookies, headers, passwords, proxy, storage keys) are used for that request only, never stored or logged.
- Hosted results are deleted after 24 hours (or your
keep_days); usage logs after 90 days. - Traffic is TLS-encrypted end to end. Backups are encrypted on the server with
agebefore they leave it. - Card payments are handled by Stripe; we never see card numbers.
Processors
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers where pages are rendered and data is stored | Germany (EU) |
| Cloudflare | DNS, network proxy, email forwarding, encrypted backups | Global |
| Stripe | Payments | Global |
| Resend | Account emails (keys, login links, alerts) | US |
| Twilio | Support voicemail | US |
Details on what's collected and for how long: privacy policy. Need a data processing agreement? Email [email protected].
Reporting a vulnerability
Found something? Email [email protected] with "Security" in the subject and steps to reproduce. We reply within two business days and won't take action against good-faith research that avoids other customers' data and service disruption.