01 / ACCESSOrganization-scoped data
Application access is scoped to the active organization, with role-based permissions and database row-level controls protecting tenant data.
SECURITY / EARLY ACCESS
Trust is a feature.
We ship it first.
API Fleet handles specifications that describe how your systems work. We protect that data with scoped access, controlled publishing, secure authentication and a deliberately small infrastructure footprint.
BY DEFAULT
The important boundaries are built in.
Security is applied at the organization, publishing and infrastructure layers—not added as a premium visual badge.
02 / IDENTITYModern authentication
Email verification, expiring password-reset tokens, secure sessions, and Google or Microsoft sign-in are supported by the application.
03 / RELEASESControlled publishing
Draft, preview and live states are separated. Published builds retain their history so teams can inspect and restore an earlier release.
OPERATIONS
What we protect and how.
Our controls are intentionally practical for an early-access service and will mature with the customers who depend on them.
- CredentialsSecrets and provider credentials are supplied through environment configuration and are not embedded in published portal assets.
- GitHub accessRepository access uses a GitHub App installation. API Fleet requests installation-scoped credentials instead of asking users for personal access tokens.
- Published assetsProduction delivery is designed for private object storage behind a CDN, HTTPS-only access and custom-domain certificate validation.
- Data requestsPrivacy, access and deletion requests can be sent directly to the founder at hello@apifleet.io.
Found something we should know about?
Please report suspected vulnerabilities privately. Include the affected URL, reproduction steps and potential impact. We will acknowledge genuine reports personally.