Security that is tested like a feature
TestPlum holds your release history and defects, so it is built to keep them isolated, attributable and safe. This page lists the controls in place today. We do not claim certifications we do not hold.
Tenant isolation
- Every project-scoped request checks the caller's active membership in the project's organization.
- Resources belonging to another organization return “not found”, so their existence is never revealed.
- Automated tests cover isolation across read endpoints, writes, cross-project links and API keys.
Authentication and sessions
- Passwords are hashed with Argon2id and a per-password salt.
- Sessions use 256-bit random tokens in HttpOnly, SameSite cookies; only a SHA-256 hash is stored, and every session can be revoked.
- Resetting a password signs out every session; login attempts are rate-limited per account and per IP address.
- Sign-in errors are identical for unknown accounts and wrong passwords, with equalised timing.
Access control and accountability
- Organization roles (owner, admin, member) and per-project roles built from 14 permissions.
- Need-to-know testers see and execute only the run cases assigned to them.
- Guards stop non-owners from changing ownership and managers from granting more than they have.
- An audit log records administrative actions, and deleted work goes to a recycle bin first.
API keys and webhooks
- API keys are scoped to one organization, stored only as hashes, expire and can be revoked.
- Webhooks are signed with HMAC-SHA256 over a timestamp and the body, retried and logged.
- Webhook targets on private, loopback or reserved networks are refused, and connections are pinned to the checked addresses so DNS rebinding cannot redirect them.
Files and content
- Uploads are checked by their actual content type against an allow-list, with size limits.
- Attachments are served with a sandboxing Content-Security-Policy and nosniff headers.
- Spreadsheet exports neutralise formula injection; images in comments only load from your own attachments.
Third-party credentials
- GitHub and Jira tokens are encrypted with AES-256-GCM and are never returned after saving.
- Without an encryption key configured, the integration is unavailable rather than storing tokens in clear.
Put your test history somewhere safe
Create a workspace, add a project and record your first run. Everything on this site is in the product today.