Security
What Trunk does with your product.
Trunk holds a copy of your product. This page says what it reads, who can see it, and what is sent elsewhere.
1
What Trunk reads
Capture needs a URL and nothing else. Nothing is installed, and Trunk never connects to your code.
- Only what a browser can load — Trunk opens the URL you give it in a browser and reads the pages it finds there.
- A sign-in only as a role you add — the automatic walk reads a page behind a sign-in only as one of your roles. Otherwise it skips the page and says so.
- The captured page is never changed — it is saved as it was read. Your edits are kept beside it.
2
Signing in to your product
To capture pages behind a sign-in, add a role with a test account, or walk the product yourself in a browser Trunk runs for that capture.
- A role's password is sealed — encrypted with AES-256-GCM. The web app cannot read it back; only the capture opens it, in memory, to sign in.
- It is typed only on your product's own site — a form that would send it anywhere else stops that role, and says why.
- What you type while walking goes to your product only — Trunk does not keep it.
- The sign-in page is not read — capture waits until you are past it.
- The session ends — when you stop it, after ten idle minutes, or after an hour at most. The pages it found are kept. The browser and its cookies are thrown away.
Pages are captured as they appear to whoever is signed in, so use test accounts that hold made-up data. Text you type into a field that is not a password can be in the saved page, if that page is then captured.
3
Who can see what
Owner · Can merge · Can edit · Can view
Every member has one access level. Only the Owner changes access or removes people.
Product access
A product is open to everyone in the company, or only to chosen people and the Owner.
Invites
An invite link works once, and only for the person whose email it was sent to.
Kept apart in the database
Each company's rows are hidden from every other company by row-level security. The database enforces it, not only the app.
4
What leaves Trunk
- A preview link — anyone who has the link can open it, with no account. It is view-only and shows one product. Someone who can edit can close it, and it stops working at once.
- Ask Trunk — when you ask for a change, the markup of the component you name and the product's tokens are sent to the model provider, Anthropic, to draw a variant.
5
Captured pages in Trunk
A captured page is someone else's HTML, so Trunk shows it inside a sealed frame. In that frame none of the page's own scripts run, and it cannot submit a form, read cookies or open a window.