Security

How ChillCode protects sessions, in plain terms. Found a problem? See the end of the page.

Hosting

• The application runs in Frankfurt, Germany (Fly.io, region fra); the database in Ireland (Supabase, AWS eu-west-1).
• HTTPS only. Data at rest in the database is encrypted by the provider (AES-256).
• Each address has a limit on requests and live connections a minute.
• Production access is limited to the people who run the service, with two-factor sign-in to the hosting and database dashboards.

Who can open a session

• The candidate’s link carries a key of 32 random bytes. The server compares it in constant time. The short session id alone opens nothing.
• When the interviewer ends the session, the key stops working at once — for the page, git, hooks and the mock MCP servers — and candidates still in it are disconnected.
• Only signed-in members of the session’s team are interviewers. Every API call checks that the caller belongs to the team the data belongs to.
• Interviewers sign in with Google or GitHub. We store no passwords.

What the candidate cannot see

The interviewer’s notes, the template’s guide and the integrity signals are sent only to the team’s connections. The server enforces this; it is not hidden in the page.

Running code

• Code never runs on our servers. Run executes in the browser of the person who pressed it, in a sandboxed frame with no access to the page, in a worker, for at most 10 seconds.
• Git push is accepted, clone and fetch are refused. Objects are kept in memory, not stored, and the size of a push is capped.

Integrity signals

No camera, microphone or screen recording. The browser reports pastes, time away and large instant edits; the candidate is told before joining.

Payments

Paddle handles checkout and the card. Card data never reaches our servers. Paddle’s webhooks are verified by signature.

Retention

Sessions are erased 7 days after their last use on Free and 30 on Team, and leave backups within 7 days. Details in the privacy policy.

Certifications

We do not hold SOC 2 or ISO 27001 yet. We answer security questionnaires on request.

Reporting a vulnerability

Write to security@chillcode.net. We answer within three working days and fix confirmed issues as fast as their severity requires. Please do not access other people’s data or disrupt the service while testing; we will not pursue good-faith research that follows this.