REMI Bloom combines application-level protections with controls that must be provided by the operator of each deployment. Security depends on both layers being configured and maintained.
- Passwords are stored using one-way hashing; plain-text passwords are not retained.
- API keys and notification tokens are masked in the UI and should be protected in server settings.
- Role, plan, and feature access checks are enforced on the server for protected APIs.
- Shared garden data is scoped to garden membership and plant sharing rules.
- Production deployments should use HTTPS to protect credentials and session cookies in transit.
- Self-hosted administrators are responsible for patching, backups, database access, and environment secrets.
REMI Bloom does not claim end-to-end encryption of user content unless your deployment explicitly implements client-side encryption where the server cannot decrypt stored records.
Report reproducible software security concerns through the Contact & Support page without publishing credentials, tokens, private records, or exploit details in a public issue.