Security

Self-hosted by default. The coordination server, database (SQLite), and dashboard run entirely on your infrastructure. We do not receive your code or task data in the default model.

SQLite database on your host. Encryption at rest is your responsibility (disk encryption). Application-level encryption at rest is on the roadmap.

The server speaks HTTP and is designed to sit behind a TLS-terminating proxy you operate. It binds 127.0.0.1 by default.

Every table is keyed by org_id (directly or via repo_id). API keys are org-scoped with an explicit per-key repository allowlist.

Bearer API keys (mgt_live_ / mgt_test_). Only SHA-256 hashes are stored — never raw keys. Keys support rotation with a 24-hour grace window and a documented recovery flow.

GitHub pull-request events are authenticated with HMAC-SHA256 (X-Hub-Signature-256) over the raw request body. Forged events are rejected with HTTP 401.

Email and password (scrypt-hashed), HttpOnly session cookies, and role-based access control. Password reset and email verification flows, plus TOTP two-factor authentication, are implemented and available today.

mgt_test_ keys operate only on an isolated sandbox organization.

An append-only audit_events table records security-relevant workspace actions — login, key rotation, role changes, webhook secret changes — with actor, action, subject, and timestamp.

Merge-replay verification_runs provide a ground-truth record of coordination outcomes.

Structured-log export to Prometheus, OpenTelemetry, or a SIEM is on the roadmap. We do not claim this capability exists today.

Minimal dependency surface (Fastify, zod, minimatch, ulid, MCP SDK, Anthropic SDK). CI generates a CycloneDX SBOM and runs npm audit, failing on high or critical advisories.

License keys are Ed25519-signed and verified offline.

Webhook HMAC verification, SSRF resolve-and-pin on outbound webhooks, default-closed CORS, loopback-by-default bind, dashboard token gate, and an adversarial out-of-territory-write harness (100% detection in the test suite). Leases remain advisory plus drift detection unless hooks/CI are enabled.

A third-party penetration test has not yet been performed. The product is built to be ready for one; the threat model is documented internally.

Not certified. The system is designed so an audit is straightforward (RBAC, audit log, access control), but certification is a separate third-party process. We do not claim certification.

Data-retention defaults, right-to-erasure tooling, and a Data Processing Addendum are on the roadmap. See our Privacy Policy for current practices. Contact us before asserting regulatory compliance for your deployment.

A formal incident-response and customer-communications process is an organizational deliverable in progress. We do not publish an incident-response SLA until a named owner commits to one.