useMeter · Legal and support pages
Security
useMeter security depends on both the software controls and the security of the server and operating environment you manage.
Technical controls
Provider credential secrets are encrypted in the database using AES-256-GCM. User passwords are hashed with Argon2id, and session tokens are stored as hashes. User data is scoped by owner identity; deleting credentials or accounts removes related records through database constraints.
The operator running an instance is responsible for USAGE_MASTER_KEY, which is used to derive the encryption key. Store the key and server/database backups with restricted access. Losing the key can make stored credentials unreadable; an operator with access to the key or server may access sensitive data.
Responsible disclosure
Please report suspected vulnerabilities responsibly. Email security@muwat.org; if that address is unavailable, contact murat@muwat.org. Include the affected component, reproduction steps, and potential impact. Do not access real user data or disrupt services, and allow a reasonable time for remediation before public disclosure.