Security
How GoldenShooter protects your data and infrastructure.
Last updated: May 29, 2026
Security is foundational to a communications platform. This page summarizes the controls we apply across the GoldenShooter platform.
Encryption in transit
All traffic to the platform is served over HTTPS with HSTS enforced. Real-time media uses encrypted WebRTC transport, and webhooks are delivered over TLS.
Authentication & sessions
Sessions use secure, HttpOnly, SameSite cookies that are not readable by client-side scripts. Passwords are hashed with bcrypt. Administrative and panel areas are separated with role-based routing and server-side authorization on every request.
Application hardening
We apply a strict Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and a scoped Permissions-Policy. Sensitive endpoints are rate-limited, and inbound webhooks are verified by signature.
Access control & auditing
Access to workspace resources is scoped per user and workspace. Administrative actions are recorded in an audit log for traceability.
Data protection
Credentials and secrets are never returned to the client in plaintext and are masked in the dashboard. Call recordings are created only when you enable them and remain within your workspace.
Reporting a vulnerability
If you believe you've found a security issue, please email support@goldenshooter.com with details. We investigate all reports and appreciate responsible disclosure.