Your secrets stay yours

Publishing to your Cloudflare account needs an API token. sbldr never stores that token in a form it can use on its own.

• Passkeys only. You sign in with a passkey: there is no password to guess, phish or leak. Add as many as you like, and remove any but the last.
• An encrypted vault. Your browser encrypts the token with a key that only your passkey can produce. We store the encrypted copy and never the key.
• Unlocked when you publish. Your browser decrypts the token just before a publish and sends it over TLS for that publish. The server holds it in memory while the publish runs and drops it afterwards: it is never written to disk, the database or logs.
• A way back. A printed recovery key holds its own copy, so losing every passkey does not mean losing your token.
• Your account, your site. Your site runs in your own Cloudflare account, and you can download the whole project at any time.