How we watch each layer.

Last updated October 18, 2026

BucketDesk is checked before a change ships and watched after it ships. Each layer has its own tool, so a problem one misses has a second chance to be caught. The main security page covers access, encryption and backups.

Code

• Aikido scans every change to our source code for security flaws such as injection, broken access checks and unsafe file handling.
• Findings are reviewed and either fixed or recorded with the reason they do not apply. Every change also goes through code review and an automated test suite.

Open-source dependencies

• Aikido checks the open-source packages BucketDesk depends on for known vulnerabilities, malicious packages and license problems.
• Our release pipeline runs its own dependency audit and blocks a release that contains a known high or critical vulnerability.

Secrets

• Aikido scans the code for passwords, keys and tokens committed by mistake.
• Production secrets are kept outside the code, and BucketDesk holds no long-lived AWS keys for your account: it uses short-lived role credentials that expire within an hour.

Infrastructure as code

• Aikido checks our infrastructure templates, including the CloudFormation template you use to connect your account, for misconfigurations such as overly broad permissions or public resources.
• The connection role is read-only by default. See every IAM action it can use.

Running application

• Sentry reports errors and warnings from the production app as they happen, with the request and code location, so we can fix problems before customers report them.
• Sentry is set up not to collect personal data such as IP addresses, cookies or request bodies. It receives error details, not the contents of your files.
• New issues alert us by email, and open issues are reviewed every day.

AWS account

• AWS CloudTrail records activity in our account and GuardDuty watches for threats such as unusual API calls or compromised credentials.
• Server health alarms on status checks, CPU and capacity alert us by email.

Questions

For more detail or a completed security questionnaire, email hello@bucketdesk.com. To report a vulnerability, see the security page.