Security at ResetUI

Security is not a checkbox at Infynite Labs — it shapes every architectural decision we make. We handle your project data, authentication tokens, and payment information, so we hold ourselves to a high standard.

This page documents our current security posture. If you're a security researcher and notice something we've missed, please see the Vulnerability Disclosure section below.

Authentication is handled entirely by Kinde, a purpose-built auth provider. We do not store passwords.

• OAuth 2.0 sign-in via Google and GitHub — no password storage on our end.
• Short-lived session tokens with automatic rotation on re-authentication.
• CSRF protection on all state-changing API endpoints.
• All authenticated API routes verify the session server-side before processing any request.
• Session tokens are HttpOnly cookies — inaccessible to JavaScript running on the page.

All payment processing is handled by Dodo Payments, a PCI DSS compliant payment processor. Your card data never touches our servers.

ResetUI runs on infrastructure from providers with strong security certifications.

• Principle of least privilege: team members have access only to systems required for their role.
• Production database access is restricted and requires VPN + MFA.
• All internal access is logged and reviewed.
• Third-party integrations use scoped API keys — no service receives broader permissions than it needs.
• Environment secrets are rotated regularly and stored encrypted.

• All API routes require valid server-side session verification — no client-side trust.
• Rate limiting is enforced on all AI routes (20 requests/minute per user) and project creation (10/hour) to prevent abuse.
• Payload size limits are enforced on all upload endpoints (16 MB per image, 25 MB aggregate).
• SQL queries use parameterised statements via Prisma ORM — no raw string concatenation.
• User-submitted content is never executed server-side.

We operate a responsible disclosure programme. If you find a security vulnerability inResetUI, we want to hear from you — and we commit to responding promptly and fairly.

Our commitments to you

• We will not take legal action against researchers who follow responsible disclosure.
• We will acknowledge your report and keep you informed as we work on a fix.
• We will credit you in the relevant changelog entry if you wish.

Please do not

• Perform automated scanning against production systems.
• Access or modify other users' data.
• Disclose vulnerabilities publicly before we have had a chance to address them.

In the event of a security incident affecting your data, we will:

• Notify affected users by email within 72 hours of confirming the breach.
• Describe what data was affected, how, and what we are doing to address it.
• Provide guidance on steps you can take to protect yourself.
• File required regulatory notifications (e.g. GDPR supervisory authority) where applicable.

Security questions or concerns? Reach our security team directly:

Last reviewed: April 20, 2026