Security Best Practices

Security is built into the Pyvorin platform through authentication, rate limiting, and privacy-conscious telemetry.

Account security

• Use a strong, unique password.
• Enable two-factor authentication from the Security page.
• Review active sessions and revoke devices you do not recognize.

API tokens

Customer API tokens are hashed in the database. Create tokens with only the abilities you need (read or read-write) and rotate them periodically.

Telemetry privacy

• Source code is not uploaded by default.
• Command text is hashed unless you explicitly opt in.
• MAC addresses are hashed; IP addresses are retained with limits.

Reporting security issues

Email security@pyvorin.com or open a confidential support ticket. Do not disclose vulnerabilities in public channels.