Security

Security starts with a clear boundary: your working Lines documents are local files, while online account services handle account access. We design and review those two surfaces separately so a website account does not silently become a storage location for your product model.

No system can guarantee absolute security. Our approach is to minimize the data we need, use layered safeguards, keep handoff explicit, and make the current product boundary understandable.

Local project files

Lines project documents are stored on your Mac in the location you choose. The app also keeps local application-support data, such as recent-file metadata and previews, to provide the desktop experience.

Working documents are not uploaded to a Lines account as part of ordinary editing. When you create a Ship export or share a file, you choose the resulting artifact and destination.

The current Lines Markdown format is inspectable and should not be treated as file-level encryption. Protect sensitive projects with macOS account security, FileVault, appropriate filesystem permissions, trusted backups, and your organization’s security controls.

Account protection

The Lines account service uses safeguards that include:

• Server-side validation and normalized account identifiers.

• Password hashing with bcrypt.

• Opaque session tokens stored as hashes on the server.

• HttpOnly, Secure, SameSite=Lax host cookies for authenticated sessions.

• Single-use, hashed email-verification tokens with a 30-minute expiry.

• Rate limits and resend cooldowns for authentication flows.

• Cloudflare Turnstile on registration and suspicious login attempts.

• Origin validation and protected-route checks at the edge.

• Content Security Policy, HSTS, clickjacking protection, MIME-sniffing protection, referrer controls, and permissions headers.

Production secrets are kept in encrypted runtime configuration and are not sent to the browser. Verification links place the raw token in the URL fragment so it is not included in the initial HTTP request or referrer.

Service providers

We use Cloudflare to host and protect the account service and Resend to deliver transactional account email. These providers maintain their own security and privacy programs. More detail about the data involved is available in our Privacy Policy — /privacy.

Your part

You can help protect your account and files by:

• Using a unique password that you do not reuse elsewhere.

• Keeping your Mac and Lines up to date.

• Enabling FileVault and a strong macOS login password.

• Reviewing exported Agent Packs before sharing them.

• Avoiding sensitive information in support messages unless it is needed to investigate the issue.

• Contacting us promptly if you believe an account or export has been exposed.

Report a vulnerability

If you believe you have found a security vulnerability in Lines or the Lines account service, email hello@nearform.co — mailto:hello@nearform.co?subject=Security%20report with “Security report” in the subject line.

Please include:

• The affected product, page, or version.

• A clear description of the issue and its potential impact.

• Reproduction steps or a minimal proof of concept.

• Any logs or screenshots that do not contain unnecessary personal data.

• A safe way to contact you with follow-up questions.

Please do not access other people’s data, disrupt the service, use social engineering, or publicly disclose an unresolved issue. We will investigate good-faith reports and coordinate next steps with the reporter where possible.