Security Policy

Keeping the data we hold safe is the one responsibility IntelliJ.ONLINE fully accepts. We combine collecting as little as possible with layered technical protection, and we keep improving it.

1. 2.1.1

   intellij.online and www.intellij.online serve only the public home site and legal pages; they never handle your projects;

2. 2.1.2

   workspace.intellij.online serves sign-in, your projects, the IDE and Contact Support;

3. 2.1.3

   gateway.intellij.online serves only the API; it accepts requests that come from the workspace and rejects others;

4. 2.1.4

   the sign-in cookie is shared only between these addresses.

1. 3.1.1

   all addresses are served only over HTTPS through Cloudflare, which also filters attacks;

2. 3.1.2

   our servers accept web traffic only from Cloudflare, and the connection between Cloudflare and our servers is encrypted and authenticated with a certificate;

3. 3.1.3

   on top of HTTPS, every request from the workspace to the API and the collaborative-editing connection are encrypted end to end at the application level with keys agreed for each session, and protected against tampering and replay;

4. 3.1.4

   pages are sent with headers that prevent framing and content-type sniffing.

1. 4.1.1

   passwords are stored only as salted Argon2id hashes;

2. 4.1.2

   email addresses and nicknames are looked up through keyed hashes;

3. 4.1.3

   sign-in and registration are rate-limited, and registrations from the same network are spaced out;

4. 4.1.4

   session tokens are random, stored only as keyed hashes, sent in an HttpOnly, Secure, SameSite=Strict cookie and expire after at most 30 days;

5. 4.1.5

   we can sign an account out on all devices and block it if it is misused or compromised.

1. 5.1.1

   the database holding accounts, projects, files, history, logs, tickets and attachments is encrypted at rest;

2. 5.1.2

   daily backups are copies of the encrypted database, and only the most recent few are kept;

3. 5.1.3

   build workspaces are separate for every project, and dependency caches are separate for every account;

4. 5.1.4

   every request for a project, file, ticket or attachment is checked on the server against its owner;

5. 5.1.5

   attachments are checked when uploaded, are shown only as image previews or downloads, and are never opened or executed by the Service.

Builds and Programs run on our servers inside isolated environments:

1. 6.1.1

   each run gets its own sandbox with separate processes, a private temporary directory and a read-only view of the system;

2. 6.1.2

   a Program can read and write only its own project and build cache, and cannot see other users' data or the Service's files and secrets;

3. 6.1.3

   Programs have no network access; build tools reach only public package repositories — the well-known ones and those named in your build files — through a filtering proxy that blocks the host machine and private networks;

4. 6.1.4

   servers, open ports and graphical windows are blocked;

5. 6.1.5

   system calls, JVM options and environment variables that could weaken isolation are filtered, and the Java runtime is started with remote-code and attach features disabled;

6. 6.1.6

   resource limits are enforced, and blocked actions are recorded.

Limits may change and may differ for individual accounts.

Administrative access is limited to the operator's authorised staff, is separated from the public parts of the Service and is recorded. It is used only for the purposes described in the Terms of Service.

We do not scan the content of your projects. Automatic protections act on behaviour — what a Program tries to do — not on what your code says.

1. 8.1.1

   use a strong password that you do not use anywhere else, and never share it;

2. 8.1.2

   sign in only at workspace.intellij.online, and never enter your password on a page that only looks like ours;

3. 8.1.3

   sign out on shared or public devices;

4. 8.1.4

   do not keep real passwords, private keys, API tokens or other people's personal data in projects, messages or attachments;

5. 8.1.5

   if you think your account is compromised, sign out and tell us immediately through Contact Support.

If you find a security problem, open a ticket in Contact Support under Bug report and start the subject with "Security". Describe the issue, the steps to reproduce it and its possible impact. Do not share it publicly until we have fixed it.

When you research the Service, you must:

1. 9.2.1

   test only your own account and projects;

2. 9.2.2

   stop as soon as you gain access to anything outside them, and not copy, keep, change, use or disclose what you saw;

3. 9.2.3

   not attack other users, our providers or our infrastructure, and not use social engineering, phishing or denial of service;

4. 9.2.4

   not degrade the Service for others, for example with load tests or automated scanning.

We will not take action against research done in good faith and within these rules, and we will credit reporters who wish it. There is currently no paid bug bounty.

If we detect a security incident, we contain it, investigate what was affected, restore protection, and notify affected users and authorities where the law requires it.

No system is perfectly secure. We continuously improve our protection, but we cannot guarantee that a breach will never happen.