Security
Last updated
This page is a short summary. The full description is on Security at Createrun.
Createrun Identity stores passwords only as salted hashes, serves every endpoint over TLS, temporarily locks an account after repeated failed sign-ins, and records sign-ins, lockouts and role changes in an audit log. You can review and revoke your active sessions under Devices & sessions, and we will never ask for your password by email. Who is responsible for what depends on how you run Createrun (self-hosted, Createrun Cloud or the development services); the full page explains the split.
To report a vulnerability, email security@createrun.com.