Honest, verified security practices
No generic "we take security seriously" slogans and no fake "military-grade" claims. Here is exactly how your API keys, auth tokens, test payloads, and user data are handled in code.
Codebase audit verified: August 31, 2026
What we never do
Never log raw credentials or tokens
Our logging pipeline automatically scrubs Authorization headers, Bearer tokens, passwords, and API keys before any log entry reaches disk.
Never send secret headers to AI providers
When you ask the AI assistant to debug a request or explain a response, all sensitive headers (Authorization, API keys, cookies, tokens) are filtered and replaced with placeholders before the prompt is sent to Google Gemini.
Never leak credentials in public share links
Public collection share links strip all Authorization headers, replace secret headers with generic placeholders, and omit environment variable values entirely — only variable names are visible.
Never sell or monetize your data
We do not sell, rent, or share your API requests, responses, collections, or account information with data brokers, advertisers, or third parties.
How we handle your API keys and credentials
Where secrets go when you configure and run requests
When you configure an API request in API Test Lab — whether with Bearer tokens, Basic auth, API keys, or custom headers — that configuration is transmitted over HTTPS to our backend proxy service.
When you execute a request, our server proxies the HTTP call directly to your target endpoint and returns the response data back to your browser. Your recent test execution metadata (status codes, latency, response headers) is stored in your private test history so you can review recent runs.
Saved requests (advanced_requests) and environment variables (request_environments) are stored as BSON documents in MongoDB and isolated strictly by account and workspace queries (user_id). They are not currently encrypted at the database field level with application-managed AES keys. If your team tests high-sensitivity production secrets that strictly require field-level database encryption at rest, we recommend using short-lived development tokens or placeholder variables.
Key Protections in Code
- Tenant Isolation: Every database read, update, or run query strictly validates ownership against the authenticated session user ID.
- Direct Proxy Execution: Requests run through our proxy to eliminate browser CORS blocks, without passing through any third-party marketing brokers.
- Public Share Stripping: Sharing a collection completely strips saved auth configs and replaces all secret header values with generic placeholders.
AI Assistant context & privacy
What the debugging bot sees and what is filtered
API Test Lab embeds an AI assistant to help you construct endpoints, write GraphQL queries, and debug errors (e.g. diagnosing 401s, 422 validation errors, or 500 crashes).
Sensitive Header Scrubber Pipeline
- Full Header Redaction: When assembling the context prompt for Google Gemini, our server strips
Authorization,Bearer ...,Cookie,x-api-key,token, and any custom headers containing secret identifiers. - Safe Placeholders: Sensitive headers appear in the model's prompt as
"[present, hidden]"so the AI understands that an auth header was provided without exposing the secret token. - No Saved Environment Leaks: The AI assistant does not have access to your workspace environment variables or stored collection passwords.
Infrastructure & authentication controls
Factual summary of technical protections
HTTPS Enforced Site-Wide
All web traffic, API routes, and WebSocket telemetry connections are TLS/HTTPS-only. Unencrypted HTTP traffic is rejected.
30-Min JWT + Rotating Refresh
JWT access tokens expire after 30 minutes. Refresh tokens (14-day validity) are stored in the database exclusively as SHA-256 hashes and rotate automatically on every refresh cycle.
SHA-256 Hashed CLI API Keys
Keys created for CI/CD or CLI usage (atl_...) are hashed with SHA-256 before saving. The raw key is returned only once at creation and is never retrievable afterward.
SSRF Protection
OpenAPI/Postman spec importers and web scanners validate destination hostnames, blocking connections to localhost, loopback, private subnets (RFC-1918), and cloud metadata endpoints.
Server-Side Token Revocation
Logging out writes the token ID (JTI) into a server-side revocation registry and immediately invalidates the associated refresh token.
Bot & Abuse Prevention
Rate limiting and Cloudflare Turnstile protect authentication routes against credential stuffing and brute-force attacks.
Report a security issue (Responsible Disclosure)
Direct contact with the engineer who builds the platform
If you believe you have discovered a security vulnerability, flaw, or data leakage bug, please email us promptly before disclosing publicly. Because API Test Lab is developed and maintained by a solo founder, your report goes directly to the developer who writes the code:
Security Contact: security@apitestlab.org (also monitored at hello@apitestlab.org)
Response SLA: We acknowledge all legitimate disclosures within 24 to 48 hours with an initial triage assessment.
Safe Harbor: If you conduct your vulnerability research in good faith without accessing other users' accounts, degrading system availability, or destroying data, we will not pursue legal action.
Security FAQ
Direct answers to common questions about credentials, sharing, and data privacy.