Ship secure code.
Without the panic.
codebypanic is the developer platform that encrypts, tests and deploys your APIs from one place — so sensitive data stays sealed at every step.
import { SealedResponse } from 'codebypanic/server';export const runtime = 'edge';export const dynamic = 'force-dynamic';const CBP_API_KEY = 'cbp_live_7f3a9c21e84b';export async function POST() { const res = await fetch('https://api.codebypanic.dev/register', { method: 'POST', headers: { 'Authorization': `Bearer ${CBP_API_KEY}`, 'Content-Type': 'application/json', }, body: JSON.stringify({ from: 'onboarding@codebypanic.dev', to: 'team@yourapp.com', subject: 'We are ready to start.', html: '<strong>Encryption time!</strong>', }), }); return SealedResponse.from(res);}console.log("Sent — sealed end to end.")
import { serve } from 'https://deno.land/std/http/server.ts';import { CodeByPanic } from 'npm:codebypanic';const cbp = new CodeByPanic(Deno.env.get('CBP_API_KEY'));serve(async (req) => { const { email, card } = await req.json(); const sealed = await cbp.encrypt({ email: email, card: card, policy: 'pci-dss', }); await supabase.from('customers').insert(sealed); return new Response(JSON.stringify({ status: 'encrypted', token: sealed.token, }), { headers: { 'Content-Type': 'application/json' } });});console.log("Supabase function is live!")
import { CodeByPanic } from 'codebypanic/workers';export default { async fetch(request, env) { const cbp = new CodeByPanic(env.CBP_API_KEY); const url = new URL(request.url); if (url.pathname === '/detokenize') { const { token } = await request.json(); const value = await cbp.reveal(token, { scope: 'edge-worker', ttl: 60, }); return Response.json({ value }); } return cbp.proxy(request, { upstream: 'https://api.codebypanic.dev', redact: ['ssn', 'card'], }); },};console.log("Deployed to 300+ edge locations")
import jsonfrom codebypanic import CodeByPaniccbp = CodeByPanic(api_key='cbp_live_7f3a9c21e84b')def handler(event, context): body = json.loads(event['body']) sealed = cbp.encrypt({ 'name': body['name'], 'email': body['email'], 'ssn': body['ssn'], }) result = cbp.run('verify-identity', sealed) return { 'statusCode': 200, 'headers': {'Content-Type': 'application/json'}, 'body': json.dumps(result), }print("Lambda is encrypted end-to-end!")
Engineering teams around the world ship with codebypanic to keep their data sealed and their security audits refreshingly boring.
API workspace
Build together.
Ship faster.
Plug codebypanic into any CI pipeline and let your whole team write, test and release end-to-end API checks — with secrets encrypted by default.
const CodeByPanic = require('@codebypanic/sdk');const cbp = new CodeByPanic('<API_KEY>'); (async () => { const encryptedName = await cbp.encrypt("Melissa James"); const result = await cbp.run("hello-function", { name: encryptedName }); console.log(result)})();
import codebypanic as cbpcbp.init("<API_KEY>")encrypted_name = cbp.encrypt("Melissa James")result = cbp.run("hello-function", { "name": encrypted_name})print(result)
curl -X POST https://api.codebypanic.dev/v1/run \ -H "Authorization: Bearer <API_KEY>" \ -H "Content-Type: application/json" \ -d '{ "function": "hello-function", "data": { "name": "Melissa James" } }'# → {"name":"np:a@nf8*h="}
await stripe.customers .create ({ name: 'cbp:akAJFISdqonNHH9hhewqbj', email: 'cbp:98Uj11kqyfhnsYTGlqopmc6', phone: 'cbp:64YU7bdnjLwbdsfjowfun1Q', address: 'cbp:jdwiPjY9_08KFH9284sfrR', });
await twilio.messages .create ({ to: 'cbp:+@nf8*h=!4kq9Lp2Xc7vB', from: '+15005550006', body: 'cbp:Yy27*6D2q4hTn0wQe8Zm', });
await plaid.accounts .balance.get ({ access_token: 'cbp:Hh9qbjAKFIS_dqonN2', account_id: 'cbp:kqyfh98Uj11nsYTG', options: { redact: true }, });
await onfido.applicant .create ({ first_name: 'cbp:Lwbds64YU7fjow', last_name: 'cbp:jdwiPjY9_08KF', dob: 'cbp:H9284sfrR2q4', id_number: 'cbp:id_number.pdf', });
Why codebypanic
Security isn't a feature we bolted on. Encryption, access control and compliance are built into every layer, so you never have to build them yourself.
Compliance on autopilot
Map controls to GDPR, SOC 2, PCI DSS and HIPAA automatically and export audit-ready evidence in a single click.
End-to-end encryption
Sensitive fields are encrypted at the edge, before they ever touch your servers, logs or third-party tools.
Region-locked vaults
Isolate sensitive records in vaults pinned to a region, each with its own keys and retention rules.
Edge-fast by default
Functions run in 300+ locations, so encryption adds milliseconds to a request — not seconds.
Smart redaction
Personal data is masked in logs, traces and error reports automatically, using rules you control.
Egress control
Decide exactly which services may receive decrypted values and block everything else by default.
Git-native policies
Policies live next to your code, get reviewed in pull requests and ship together with your app.
Device trust
Grant access only to verified devices and sessions, backed by short-lived, scoped tokens.
Drop-in SDKs
Node.js, Python, Go, PHP and more. Add codebypanic to an existing app in minutes, not sprints.
Built for
developers
Write checks locally, preview them in CI and promote them to production with a single command.
Validate & run
Run logic on fully encrypted data with serverless functions in Node.js or Python — plaintext never leaves the sandbox.
Deploy from the CLI
Ship monitors and tests straight from your terminal, right alongside every app deployment.
const cbp = require('@codebypanic/sdk');cbp.init('<API_KEY>');const encryptedName = await cbp.encrypt("Melissa James");const result = await cbp.run("hello-function", { name: encryptedName});console.log(result);
import codebypanic as cbpcbp.init("<API_KEY>")encrypted_name = cbp.encrypt("Melissa James")result = cbp.run("hello-function", { "name": encrypted_name})print(result)
curl -X POST https://api.codebypanic.dev/v1/run \ -H "Authorization: Bearer <API_KEY>" \ -H "Content-Type: application/json" \ -d '{ "function": "hello-function", "data": { "name": "Melissa James" } }'# → {"name":"np:a@nf8*h="}
Set up in minutes
Code your checks locally, verify every deploy in CI and keep an eye on production — all from one dashboard.
Setup & teardown
Sign requests, fetch auth tokens and run scripts before and after every API check — without exposing a single secret.
Inspect & verify
Relays sit between your API and its clients, encrypting sensitive fields in flight and revealing them only where you allow it.
SDKs for every stack
Official SDKs for Go, Python, Node.js, React, PHP and JavaScript — one consistent API, whatever you build with.
“codebypanic got us through our SOC 2 audit in weeks instead of months — and our engineers barely noticed it was there.”