Security

What Mystra touches, and what it keeps

A monitor that signs up and pays on your app deserves a plain answer to "what exactly does it do with my product?" This is that answer.

On your app

  • You prove you own the host before any run: a DNS TXT record at _mystra.<host>. Mystra never runs against a domain you have not verified.
  • Throwaway accounts only. Every run signs up as run-<id>@inbox.mystra.run. Mystra never signs in as a real user, and the cleanup webhook lets your app delete the account the moment the run ends.
  • No payment, ever. The payment step reaches Stripe Checkout, reads the plan and amount, and stops. Nothing is charged and no card is typed.
  • Read-only otherwise. The runner clicks what a new customer clicks: the signup form, the email link, the upgrade button. It does not crawl, does not submit other forms, and stops at the paid area.

What we store

  • Your account: name, email and profile picture from Google or the magic-link sign-in.
  • Your app's configuration: host, paths, selectors, the Stripe price id you expect, alert channels.
  • Evidence: screenshots, a video, a HAR network capture and the console log of each run of your own app. Broken runs are kept 30 days, passed runs 7 days, pinned runs until you unpin them. Delete an app and its evidence goes with it.
  • Inbound email sent to the run inboxes, kept for the run and removed with its evidence.

The HAR captures the requests the browser made on your app during the run: URLs, methods, headers, status codes, timings and the bodies the browser sent. Response bodies are deliberately not recorded. Headers and cookies are, so anything the run's own throwaway session was issued is in there — one more reason a share link is worth a look before you post it.

Secrets and signatures

  • The deploy-hook secret is shown once and stored as a hash. Rotate it in settings any time.
  • Vercel webhooks are verified with HMAC-SHA1 against the secret you paste; the cleanup webhook is signed with HMAC-SHA256 using a per-app outgoing secret, so your endpoint can reject anything else.
  • Share links are signed tokens you can revoke. Evidence URLs are private to the owner or a valid share token.
  • Mystra stores no card numbers. Billing for Mystra itself runs through Stripe Checkout and the Stripe customer portal.

Where things run

  • Application and runner: Vercel (Frankfurt region for functions).
  • Database: MongoDB Atlas.
  • Email in and out: Resend, EU region.
  • Product analytics and error tracking: PostHog, EU region. No evidence or email content is ever sent there.
  • Traffic and revenue attribution: DataFast. Pages and referrers only; see the privacy policy.

Reporting a vulnerability

Email security@mystra.run with what you found and how to reproduce it. You will get a reply from a human within two working days, credit if you want it, and no legal trouble for good-faith research that does not touch other customers' data.

Questions that are not vulnerabilities go to contact. The privacy policy has the formal version of the storage section above.