Security

How your code and data are kept apart from everyone else's, and what is not done yet.

Isolation

Each deployment runs in its own container: not privileged, with Linux capabilities dropped, and unable to gain new privileges.
No file or directory of the server is mounted into it, and it has no access to the container engine.
Each project has its own private network. Its database and Redis are reachable only from there; nothing but the web port is reachable from outside, and only through the proxy.
Memory, CPU, the number of processes and disk are capped per container.

Variables, database passwords, storage keys and your GitHub access token are encrypted with AES-256-GCM before they are stored. The key is not in the database.
Variable values are never returned by any page or API call, and are masked in logs.
API tokens are shown once; only a hash is stored. A token cannot create, list or revoke tokens.

Sign-in is through GitHub; there are no passwords to leak here.
Every request is checked against the account it belongs to. One account cannot see another's projects, even by guessing an id.
Tokens can be read-only or limited to one project, and destructive actions asked for with a token wait for a person.
The audit log records who — a person, a token by name, or the platform — did each thing.

Applications share the server's kernel. A stronger sandbox between application and kernel is tested and planned before sign-up opens to the public.
The preview runs on a single server: if it is down, applications on it are down.
There is no two-factor step beyond the one on your GitHub account.