Security
How MrCron protects your data and credentials
Credential encryption
All API tokens and secrets you connect are encrypted at rest using AES-256-GCM with a random 12-byte IV per record. The encryption key is stored separately from the database and never logged. Credentials are only decrypted in memory during scheduled sync jobs running on the server — they are never returned to the browser or included in API responses.
Read-only by design
MrCron only reads data from your integrations — it does not write to Sentry, Stripe, GitHub, or any other connected tool. We request the minimum scopes necessary. For example, the GitHub integration requests repo:read and deployments:read — not write access.
Authentication
MrCron uses magic-link authentication (passwordless email login via Resend). There are no passwords to leak. Sessions are signed with a server-side secret and validated on every request. All dashboard routes require an authenticated session.
Transport security
All traffic between your browser and MrCron is encrypted over HTTPS. Connections to integration APIs use HTTPS with TLS certificate validation — we do not accept self-signed certificates from external services.
Ping endpoint
The /api/ping/[token] endpoint is unauthenticated by design — it must be callable from your cron jobs without session cookies. Tokens are 64-character cryptographically random hex strings generated with crypto.randomBytes(32). The endpoint is rate-limited per token.
Responsible disclosure
Found a security issue? Please email security@mrcron.com before disclosing publicly. We take security reports seriously and will respond within 48 hours.