App
Your account, better protected
Passkey sign-in, connected devices in plain sight, encrypted secrets, and a penetration test that led to changes.
PostShip has access to what runs your sites: your hosts, your team channels, your Stripe account in read-only mode. Its security is therefore yours too.
Signing in
No password: a code sent to your address, your Google or GitHub account, or a passkey — fingerprint, face or hardware key —, tied to your device and to postship.fr. A new code is only sent once a minute. After signing in, you land straight in your workspace, even after a second factor or accepting new terms.
Your devices
Account → Security lists every browser and phone where your account is open: browser, system, approximate location, last activity. You can rename one, sign it out, or sign out all the others at once. A sign-in from a device never seen before sends you an email. A workspace owner can require two-factor authentication from its members.
Your secrets
Your Discord and Slack channel addresses, the secrets that sign your webhooks, your host tokens and your Stripe key are encrypted in the database; they are only opened to send an alert or check a signature.
A penetration test, and what followed
On 26 September 2026, a penetration test targeted PostShip, in production and in the code. The screen that connects a terminal now says which workspaces and projects the key will be able to read, and warns that a code received from someone else must not be authorised. The /.well-known/security.txt file says how to report a vulnerability to us.