Security

Last updated September 16, 2026

How your data is protected

Authentication is handled by Discord OAuth through Supabase Auth - we never see or store your Discord password. Sessions use signed JWTs.

Every project and build row is scoped to your user ID and protected by Postgres row-level security. Other users cannot read or modify your data.

The obfuscation endpoint requires an authenticated session - anonymous requests are rejected.

Source handling

Submitted source and obfuscated output are stored with your build record, scoped to your account and protected by row-level security. Source is never written to logs.

Scope of obfuscation

Obrion raises the cost of reading your code - it is not encryption and does not make code unrecoverable. Treat obfuscation as one layer of defense, not a guarantee.

Reporting a vulnerability

Found a security issue? Please report it privately through the project's GitHub repository rather than opening a public issue. We'll acknowledge and address it as quickly as possible.