Found a vulnerability? Thank you — please report it privately.
Reporting
For AI Juggler, use GitHub private vulnerability reporting on its repository. For this website or account services, email info@figurehead.ai with "Security" in the subject.
How we protect account data
- Sessions are sealed, HTTP-only cookies; sign-in uses PKCE via WorkOS AuthKit.
- Machine tokens are random 256-bit values stored only as SHA-256 hashes.
- Pairing codes are single-use and expire after 10 minutes.
- Backups are encrypted client-side before upload; we only ever hold ciphertext.