How we build
- Every change is covered by automated tests and type checks before it can ship.
- Every change gets a second, independent review before it is merged.
- Secrets and keys live on the server only. Sensitive keys are encrypted at rest.
- Staff access to our back office requires two-factor authentication.
- We keep dependencies small and update them on a regular schedule.
How we protect your data in our products
- All traffic is encrypted in transit with HTTPS.
- Each customer's data is isolated from every other customer's at the database level.
- Data is encrypted at rest by our hosting infrastructure.
- We never sell your data, and we use it only to run the product for you.
This website
barakatlabs.com sends strict security headers on every page, including a content security policy that blocks scripts from every other origin except Meta's pixel, which loads only if you accept cookies. The contact form is checked on our server and passed to our business system over an authenticated connection; this website itself stores nothing.
Reporting a vulnerability
If you believe you have found a security issue in barakatlabs.com or any Barakat Labs product, email hello@barakatlabs.com with “Security” in the subject. Please include steps to reproduce it. We will reply within a few business days and keep you updated until it is fixed.
Please test only against your own account, do not access or change other people's data, and give us reasonable time to fix the issue before sharing it publicly. We won't take action against good-faith research that follows these rules.