Security

Security isn't only about this website — it's about the products you run. We build our tools and hardware to keep your data yours, and we're direct about what leaves your machine and what doesn't.

Last reviewed July 15, 2026

CANoli

CANoli is a desktop CAN bus analysis app. The data it works with — your bus traffic — is sensitive, so it's designed to stay local by default.

• ✓ Your CAN captures, logs, and DBC files stay on your machine. They are never uploaded to us.
• ✓ Telemetry is opt-in and off by default, behind two independent in-app consent toggles (Help menu). Nothing leaves your machine without explicit consent.
• ✓ Crash reporting (Sentry) scrubs CAN payloads, DBC text, file and log paths, license keys, and usernames out of every event before it is sent.
• ✓ Product analytics (PostHog) are anonymous feature-usage events only (e.g. "opened trace view"), tied to a random per-install id — no personal data.
• ✓ AI features connect your session to an AI agent over MCP. CAN data is shared with a model only when you turn it on, and you choose the provider.
• ✓ Works fully offline: a built-in virtual CAN adapter lets you run without hardware or a network connection.

Connected (IoT) products

As we ship connected hardware, security is a design requirement, not an afterthought. Our approach for every IoT product we build:

• Secure boot and signed firmware, so a device only runs software we signed.
• Signed over-the-air updates, so security fixes reach the field quickly and safely.
• Encrypted communications (TLS) between devices, apps, and any backend.
• No shared default passwords — unique, rotatable credentials provisioned per device.
• Least-privilege access and network segmentation between components.
• A clear end-of-life and security-update policy published per product.

These describe how we build IoT products going forward; specifics are documented per product at launch.

Website & checkout

The site you're on, the shop, and customer accounts are protected by:

• ✓ HTTPS is enforced everywhere, with HSTS (2-year max-age, including subdomains).
• ✓ A strict, enforced Content-Security-Policy plus hardening headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy).
• ✓ Payments run through Stripe — we never see or store your full card number; card data never touches our servers.
• ✓ Customer sign-in is passwordless (one-time email links); there is no customer password to steal.
• ✓ Admin accounts use scrypt-hashed passwords with optional TOTP two-factor, and session tokens are stored only as SHA-256 hashes (never in the clear).
• ✓ Public endpoints are rate-limited and abuse-scored to blunt brute-force and spam, and state-changing requests are same-origin checked.

Reporting a vulnerability

If you believe you've found a security issue in a Salvatorre product or on this site, we want to hear from you. Please report it through our contact form with the details and steps to reproduce. Please give us a reasonable chance to investigate and fix the issue before disclosing it publicly; we'll acknowledge your report and keep you posted. We don't run a paid bug-bounty program yet, but we're grateful for good-faith reports and will credit you if you'd like.

Machine-readable contact info is published at /.well-known/security.txt.