RotorLab logo RotorLabDocs

Security and privacy

This page summarizes how RotorLab protects your account and your data. It is written for someone evaluating the product, not as an audit report.

Passwords and sessions#

Passwords are stored only as scrypt hashes with per-user salts. RotorLab never stores or logs a plain-text password.

Session and password-reset tokens are stored only as their SHA-256 hashes, so a copy of the database does not yield usable sessions. Session cookies are HttpOnly and SameSite=Strict, which keeps them out of reach of page scripts and cross-site requests. Sessions are revoked when a password changes or an account is deactivated, and repeated failed sign-ins are throttled.

API keys#

API keys are shown once, at creation, and stored only as a SHA-256 hash. If a key is lost it cannot be recovered, only replaced. Keys are created on demand, never automatically, and can be revoked immediately. See API access.

Live telemetry#

Telemetry read over USB (Web Serial) or a LAN WebSocket bridge stays on your machine: nothing from those paths leaves your browser. The cloud relay carries raw MAVLink between your agent and your browser without parsing it, and every relay channel is keyed to your account, so only your own browsers can join your agent's channel. One account's live link is never reachable from another. See Cloud relay.

Application hardening#

The server rejects requests whose Host header does not match the served host (which blocks DNS rebinding), rejects state-changing requests that carry a cross-site Origin (which blocks cross-site request forgery), HTML-escapes all user-supplied text everywhere it is rendered, uses parameterized SQL exclusively, caps request bodies, and sends standard hardening headers. These protections are exercised by an automated test suite that mounts each attack against a live server and asserts it is blocked.

The full legal documents are published in the app: