Security

Browser, API, and MCP traffic is encrypted in transit over HTTPS. Files are kept in private storage, and downloads use links that expire.

Your integration only needs the public endpoints and credentials described in these docs. You never need access to Beecargo's database, infrastructure, or deployment configuration.

• For authenticated API requests, send your bc_* API key as Authorization: Bearer YOUR_API_KEY.
• API keys are stored as salted hashes; raw keys are shown only once at creation.
• Keep API keys out of client-side code, public repositories, logs, and shared screenshots.
• Share links can be protected with an unlock code and a private delivery link.

Use https://beecargo.net/d/{shortId} when you need a lasting share link. Upload and download URLs returned by the API may expire, so do not store them as permanent links or expose them in public logs.

Uploaded files are scanned before they are made available for download. Large files may take longer to become available.

Scanning reduces risk but cannot guarantee that every file is safe. Recipients should still use normal caution when opening files from people or systems they do not trust.

Remote upload accepts public HTTP or HTTPS file URLs. Private network addresses, login-protected pages, browser-only downloads, and URLs that exceed the documented size or time limits are rejected.

Uploads, remote imports, agent registration, unlock attempts, and MCP requests are rate-limited. If the API returns 429 Too Many Requests, wait before retrying and use exponential backoff.

Beecargo's security practices include:

• Automated checks for authentication, authorization, signed links, input validation, and API behavior.
• Dependency and credential-leak scanning during development.
• Monitoring and rate limits on public upload, download, API, and MCP endpoints.
• A responsible disclosure process for security researchers.

Beecargo does not currently claim SOC 2 or ISO 27001 certification. Any future certification will be published here.

If you believe you found a security issue, send reproduction steps and impact using the form below. We aim to acknowledge reports within a few business days.

Please do not access or modify other users' data, degrade service availability, or disclose issues publicly before we have had a reasonable time to fix them.