gluer.io
Security

A connectivity layer you can reason about

Gluer sits between systems, so its security model has to be simple enough to audit: two keys per project, one routing rule, and no inbound ports on your side.

Frontend key

Public

Ships in browser and mobile bundles and identifies the project on client connections and on the REST bridge. It cannot register plugins or impersonate a worker.

Backend key

Private

Authenticates workers that register plugins and answer messages. It lives in your server environment only and should be rotated if it ever reaches a client bundle or a log.

Controls

What the platform enforces

Controls that are on for every project, at every layer between a client and a worker.

Transport

  • TLS for every hosted connection (wss:// and https:// only)
  • MessagePack framing with per-message size limits
  • Heartbeats and idle disconnection for stale sockets

Tenancy

  • Every message carries its project; routing never crosses projects
  • Session-scoped replies, so one client cannot read another's response
  • Workers only receive messages for plugins they registered

Accounts

  • Passwords hashed with bcrypt, never stored or logged in clear text
  • One-time login codes are short-lived, single-use and rate limited
  • Password reset links are single-use, expiring and stored hashed

Application

  • Strict Content-Security-Policy and HSTS on gluer.io
  • Server-side validation of every auth payload
  • Sessions expire automatically and can be revoked on logout
Your side

Four habits that keep a project safe

Gluer secures the transport and the tenancy. Authorisation of business actions stays where your logic lives.

Keep the backend key server-side

Load it from your secret manager or environment. If it appears in a client bundle, a CI log or a screenshot, rotate the project keypair.

Validate on the worker, not the client

Client keys are public by design. Treat every incoming action as untrusted input and authorise it inside the worker, exactly as you would an HTTP handler.

Scope one project per environment

Separate projects for development, staging and production keep test traffic and leaked development keys away from production data.

Verify webhook signatures

The REST bridge delivers the raw payload to your worker, so keep verifying the vendor's signature (Stripe, GitHub, etc.) inside your own code.

Roadmap

What we are building next

Published so you can plan around it. If one of these is a blocker for your team, tell us and it moves up.

Talk to us about security
  • Per-project allowed origins and IP allow-lists
  • Scoped, revocable worker tokens with rotation
  • Optional message payload encryption end-to-end
  • Audit log export and anomaly alerts
  • Two-factor authentication and SSO for accounts

Connect your first two systems today

Create a project, drop the SDK into your app, and point a worker at it. Free while you build, no credit card, no infrastructure to provision.

Start for free Read the docs