Security
This page describes what Rebound actually does to protect your data. It is limited to properties of the system as it is built — we would rather say less here and have all of it be true.
Owner-scoped data access
Every table holding your data enforces access at the database layer, not just in application code. Row-level security policies tie each row to the account that owns it and compare it against the authenticated user on every query. An application bug that asked for someone else’s row would still get nothing back.
This is also designed to fail closed: where the expected database structure is missing or a policy cannot be evaluated, the request is refused rather than falling back to broader access. A misconfiguration turns features off; it does not open data up.
Encryption in transit
All traffic between your browser, our application, and our database and AI providers travels over TLS. The application sets HTTP Strict Transport Security, so browsers will refuse to downgrade to an unencrypted connection.
Authentication and credentials
Sign-in is handled by Supabase Auth, a managed authentication service. We never store raw passwords. Rebound holds session tokens issued by that service and revalidates them with the provider on each request rather than trusting a session cookie on its own.
Least privilege for service credentials
Server-side credentials for our database and AI providers are held only by the server, are never shipped to the browser, and are scoped to the narrowest access each task needs. Secrets are injected at runtime from a managed secret store and are not committed to the codebase.
Application hardening
- Baseline security response headers are set on every route, including a content security policy that forbids the app being framed, plus
X-Frame-Options: DENY,X-Content-Type-Options: nosniff, and a strict referrer policy. - AI-suggested changes to your schedule are previewed and confirmed by you before anything is written, so a bad model response cannot silently rewrite your plan.
- Study set share links are opt-in, scoped to the single set you shared, and revocable — revoking one stops it resolving immediately.
- Errors are reported to Sentry so faults are found and fixed rather than silently swallowed.
What we are not claiming
We hold no third-party security certification, we have not completed a SOC 2 or ISO 27001 audit, and we do not currently offer end-to-end encryption where only you hold the key — the AI features require the server to read the content you send them. If your coursework is subject to a confidentiality obligation, take that into account before uploading it.
Responsible disclosure
If you find a vulnerability, please tell us before telling anyone else. Email security@reboundai.app with:
- A description of the issue and what an attacker could achieve.
- The steps needed to reproduce it.
- Any proof-of-concept, logs, or screenshots you have.
We ask that you:
- Use only accounts and data you own — do not access, modify, or retain anyone else’s information.
- Avoid denial-of-service testing, spam, social engineering, and physical attacks.
- Give us reasonable time to fix the issue before publishing it.
We will acknowledge your report, keep you updated while we work on it, and credit you when it is fixed if you would like us to. We will not pursue legal action over good-faith research that follows these guidelines. We do not currently run a paid bug bounty.
Contact
Security reports: security@reboundai.app. For privacy questions, see our Privacy Policy.