No SQL to inject
Whatever someone types into your app is only ever treated as data, never as a command. The classic trick of typing database code into a search box or login form to read or wipe your data has nothing to work on.
Secure by construction,
not by checklist
While most apps get secure one fix at a time, on Arrowdot whole classes of vulnerability can't be written in the first place: there is no SQL to inject, no password table to leak and no secret keys sitting in your code.
What every Arrowdot app gets on day one
Sign-in, done for you
Accounts, passwords and sign-in are handled by Arrowdot, not your app. Signing someone out ends their session on our servers, so an old login can't keep working.
Users can't pretend to be someone else
Your app always knows who is really signed in. That comes from our servers, never from anything the browser sends, so nobody can claim to be someone else.
When in doubt, it says no
If an access rule can't be checked for any reason, the action is refused. A broken rule never turns into an open door.
No forgotten endpoints
Your app has no hand-written routes, so there's no endpoint someone forgot to protect. Every action goes through the same checks on the server, every time.
Secrets never touch your code
Keys for everything your app connects to are encrypted and stored outside of your app, remaining locked until the exact moment of use.
Safe connections for agents and other tools
Connect your app to other software with an API key. A key only sees the data its creator can see in the app, so sharing one never hands out more access than you have. Make it read-only and it can never change anything.
Uploads can't run code
A file carrying hidden code can't run inside your app or reach your users' accounts.
Nothing is ever overwritten
Every change is saved as a new entry in your app's history, never written over the old one. If something goes wrong, everything that came before is still there.
The security work you'd usually do yourself
On a typical stack each of these is a ticket, a library and a code review. On Arrowdot it's already done.
| On a typical stack | On Arrowdot |
|---|---|
| Hash and store passwords, build reset flows, manage sessions | Handled by the platform |
| Guard every database query against injection | No query strings exist |
| Check which fields every request may change | Derived from your data model |
| Keep third-party keys out of code, env files and logs | Encrypted vault, references only |
| Guard against harmful file uploads | Handled by the platform |
| Configure servers, TLS, databases and CORS per app | Nothing to configure |
| Write auth checks on every API route | API reads use the app's own rules |
| Build an audit log of who changed what | Every change is recorded |
Your part: say who can do what
The platform guarantees that your access rules exist on the server, can't be forged by a browser, and refuse when they can't be checked. What it can't know is your business: whether a list is shared with everyone or private to each person.
So you say it in plain words, and Arrowdot turns that into a rule the server enforces on every action and every read.
Simple
Advanced
“Only the person who placed an order can cancel it.”
- Olivia cancels her own orderAllowed
- Sam tries to cancel Olivia's orderRefused
Checked on our servers, for every request.
Build something. Skip the security backlog.
Describe your app and get a secure foundation without a single line of auth code.
Found a vulnerability? See our disclosure policy .