moula · Security

Security posture

An advertising tool that lives inside your editor has to clear a very high bar of trust. Here is how moula is built, and how to tell us if we have got something wrong.

How the client is built

• No file patching. moula only renders its own status bar item through public VS Code APIs. It never writes, modifies or reads another application’s files on disk. Uninstalling leaves your editor byte-for-byte identical.
• No CSP changes. moula does not alter your editor’s Content-Security-Policy, or any other host setting, in order to inject content.
• No unsigned auto-update. moula does not update itself silently in the background and does not fetch executable code at runtime. You update it through the extension marketplace, like any other extension.
• Keys in SecretStorage. Your API key is held in VS Code’s SecretStorage — the operating system’s secure credential store — never in plain-text settings or a config file.
• HTTPS-only endpoint, machine-scoped. The API base URL is machine-scoped configuration, and production traffic is HTTPS only.

How the marketplace is protected

• HMAC-signed click URLs. Every click URL carries an HMAC signature over its impression id, verified with a constant-time comparison. Impression ids cannot be guessed or incremented to forge clicks or inflate the click-through rate.
• Billing is authoritative on the server. Impressions and clicks are recorded and billed on our servers, never on the strength of trusting the client. Credits run inside atomic, security-definer database functions that deduplicate retries, enforce a minimum interval between impressions, cap spending at the campaign’s budget, and credit each click exactly once.
• Keys never stored in the clear. We keep only an irreversible fingerprint of your API key (a SHA-256 hash): the key itself is shown to you once at creation, and after that we no longer hold it anywhere. A database breach therefore reveals no usable credentials.
• Row-level security. Every table enforces row-level security so that one account can never read another account’s impressions, clicks, keys or campaigns.

Responsible disclosure

If you find a security problem, please report it privately and give us a chance to fix it before any public disclosure. We undertake to:

• Acknowledge your report within 72 hours of receiving it.
• Keep you informed as we investigate, and credit you if you would like that.
• Not bring or support legal action against good-faith research that respects users’ privacy, avoids service disruption, and neither accesses nor modifies data beyond what is needed to demonstrate the problem.

Security contact: security@moula.io. Machine-readable details, including our signature and preferred languages, are published at /.well-known/security.txt.