satsuサツ

Security & responsible disclosure

Last updated: 5 November 2026

We take the security of Satsu seriously. If you believe you have found a vulnerability, please tell us privately so we can fix it before it affects anyone.

Scope

The following properties are in scope:

  • satsu.pro
  • api.satsu.pro
  • track.satsu.pro
  • status.satsu.pro (live status and incident history)

How to report

Email security@satsu.pro. Please include:

  • A description of the issue and its potential impact
  • The affected URL, endpoint or component
  • Steps to reproduce, or a proof of concept
  • How you would like to be credited, if at all

Please do not access data that is not yours, and do not publish details before we have had a chance to fix the issue.

What we promise

  • We acknowledge your report within 5 business days.
  • We fix the issue before any public disclosure.
  • We credit you on request once the fix is released.

Out of scope

  • Denial-of-service attacks
  • Social engineering of staff or users
  • Vulnerabilities in third-party services we use
  • Findings on the archived legacy snippet

Bug bounty

We do not run a bug bounty program and cannot offer monetary rewards. We are grateful for every responsible report.

How API keys are stored

  • On our side, keys are hashed. We store only a SHA-256 hash of each API key, never the key itself. The full key is shown once, when it is created. We cannot recover it; revoke the key and create a new one instead.
  • CLI sign-in codes are hashed too. The secret code the satsu-analytics CLI uses to sign in is stored as a hash, expires after 10 minutes, and the key it creates is handed to the CLI exactly once.
  • On your machine, the key lives outside your project. On macOS and Linux the CLI stores it in ~/.config/satsu-analytics/credentials.json with file mode 0600, so only your user account can read it. On Windows the file is %APPDATA%\satsu-analytics\credentials.json in your user profile.
  • Nothing secret is written into a project. init adds the component, your public site ID and, if you connect a coding agent, an MCP config that contains only the command npx -y satsu-analytics mcp. These files are safe to commit; a teammate runs npx satsu-analytics login once to get their own key.
  • Revoking takes effect immediately. Revoke a key under Settings → API keys and the next request with it is rejected.