Trust center / Security

Production context without collecting everything.

FetchNode uses scoped project keys, bounded payloads and conservative generated defaults. You decide when more context is appropriate for your application.

DEFAULT

Sensitive request data stays off

Bodies, headers, IP addresses, query strings, SQL parameters and raw SQL text are disabled. Normalized query structure is enabled for N+1 detection.

ACCESS

Keys and external access are scoped

Public browser keys cannot create release markers. Private server keys can be revoked per project. Google Search Console uses read-only OAuth and encrypted credentials.

RETENTION

Raw history has a defined lifetime

Plan retention is enforced for errors, requests, product analytics, browser quality, jobs and client delivery reports. Project deletion invalidates remaining keys.

Capture matrix

What the default setup sends

SignalDefault
Exception type, message and application stack frames
On
Django route, method, timing and internal user ID
On
Environment, release and bounded breadcrumbs
On
Headers, request body, query string and IP address
Off
SQL statement text
Off
Browser analytics before consent
Off

Application controls

  • • Per-project browser and server keys.
  • • Key revocation, rotation and optional expiry.
  • • Organization and project roles for dashboard access.
  • • Read-only Google scope with OAuth state and PKCE validation.
  • • Search Console tokens encrypted with a dedicated deployment key.
  • • Bounded ingest size and per-project rate limiting.
  • • Scanner-noise filtering before visible issue alerts.

Operational controls

  • • HTTPS is required for production deployment.
  • • Stripe hosts checkout and payment-method handling.
  • • Readiness checks cover the database and configured cache.
  • • Raw telemetry is cleaned up against plan retention.
  • • Security concerns can be reported directly to the founder.

Report a security concern

Please do not include production secrets or customer data in the first message. Describe the affected surface and a safe way to reproduce the issue.

Contact the maintainer through GitHub first. Do not disclose vulnerability details in a public issue.