Security at Devlens

Infrastructure

Devlens runs on Vercel (compute) and Supabase (database). Both are SOC 2 Type II compliant providers with enterprise-grade security postures.

• –All traffic encrypted in transit via TLS 1.3
• –Database encrypted at rest using AES-256
• –Deployments run on isolated, ephemeral serverless functions
• –No persistent server processes — reduced attack surface
• –CDN edge network for DDoS mitigation (Vercel Edge Network)

SDK Key Security

Every game you register gets a unique SDK key in the format sk_live_.... These keys authenticate your game's events to our ingest API.

• –SDK keys are hashed before storage — we never store raw keys
• –Keys are scoped to a single game — a compromised key cannot access other games
• –Keys can be rotated instantly from your dashboard
• –Failed authentication attempts are rate-limited and logged

Authentication

Dashboard login is powered by Clerk, a dedicated authentication provider. We do not store passwords — Clerk handles all credential management, MFA, and session security.

• –Supports Google OAuth and email/password login
• –Multi-factor authentication available on all accounts
• –Session tokens expire and rotate automatically
• –All auth events are logged in Clerk's audit trail

Data Isolation

Each Devlens account's data is logically isolated in our database. All queries are scoped by game_id and user_id with server-side enforcement — it is architecturally impossible for one developer to access another's analytics.

• –Row-level security (RLS) enabled on all Supabase tables
• –API routes validate SDK key ownership before reading or writing any data
• –Admin access to production data is limited to core team with MFA

Rate Limiting & Abuse Prevention

The ingest API is rate-limited to prevent abuse and protect data quality:

• –Per-key rate limit: 1,000 events/minute (Free), 10,000/minute (Pro+)
• –Burst protection: requests exceeding limits return 429 Too Many Requests
• –Suspicious patterns (mass identical events, impossible timestamps) are flagged
• –Repeated abuse results in automatic key suspension

Payment Security

All payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. Devlens never sees, touches, or stores your card details. We store only your Stripe customer ID and subscription status.

AI Pipeline Security

Daily insights are generated by sending aggregated, anonymized summaries to AI models via OpenRouter. We never send raw event data, player IDs, or personally identifiable information to AI providers.

The prompt sent to the AI model contains only: game name, metric totals, and percentage changes — no individual player data.

Vulnerability Disclosure

We take security reports seriously and respond promptly. If you discover a vulnerability in Devlens, please report it responsibly.

In scope: devlens.cloud, api.devlens.cloud, the Lua SDK on GitHub, the Devlens dashboard web app.

Out of scope: Social engineering, physical attacks, denial of service, attacks on third-party providers (Clerk, Stripe, Supabase, Vercel).

We do not offer a bug bounty at this stage, but we deeply appreciate responsible disclosures and will acknowledge researchers publicly if desired.

Questions

For general security questions: security@devlens.cloud

For privacy questions: privacy@devlens.cloud — or read our full Privacy Policy.