Security overview

Cairn Script handles credentials, customer code, and the script delivery path for Webflow sites. We take that responsibility seriously. This document summarizes the controls in place; if you need additional detail for a procurement review, email security@cairnscript.com.

Encryption

• All traffic to and from Cairn is HTTPS-only.
• Sensitive credentials (Webflow OAuth tokens, Git access tokens, legacy Webflow API keys) are encrypted at rest using AES-256-GCM via our internal CredentialCipher service.
• Database backups are encrypted at rest. Database connections are TLS-secured.

Outbound request safety

Our outbound HTTP client runs every user-supplied URL through an SSRF guard that blocks RFC1918 private ranges, link-local, IPv6, instance metadata endpoints, and DNS rebinding. This applies to dependency fetches and any Cairn-side processing of URLs you provide.

Authentication

Cairn uses Laravel Fortify for authentication. We support email + password with bcrypt, optional TOTP-based 2FA with backup recovery codes, and WebAuthn passkeys.

Access controls

Workspaces are tenancy boundaries. Every team-scoped query is filtered by the current workspace at the Action layer. Role-based permissions (Admin / Member / Viewer) gate destructive operations.

Operational practices

• Production deploys go through CI on every merge to production.
• Least-privilege access to production systems.
• Dependency updates via Dependabot, with security-only updates auto-applied.
• Audit logs for sensitive operations (token issuance, workspace transfers, deletions).

Reporting vulnerabilities

Found a security issue? Please email security@cairnscript.com. We acknowledge within 24 hours and follow up with a disclosure timeline.