All systems operational

Your code never
leaves the scan.

Zero permanent storage. Per-org encryption. Sandboxed scanners. Every security guarantee backed by architecture, not policy.

AES-256-GCMPer-org encryption keysEncrypted checkoutsRead-only accessDocker sandboxingMax 2h code lifetime
Request Security ReviewFull Details
Security Principles

Built secure
by architecture.

Security isn't a feature we added — it's how the platform works. Every design decision prioritizes data isolation and minimal access.

Zero code storage

Source code is cloned, scanned, and deleted. Never stored permanently. Maximum 2-hour lifetime, enforced by scheduled cleanup.

Per-org encryption

Each org gets its own encryption key. Credentials are isolated — one org's breach can't compromise another.

Sandboxed scanners

SAST tools run in Docker with no network, read-only filesystem, and strict resource limits.

Read-only access

We use read-only VCS tokens. No writes to your repo except remediation PRs you explicitly approve.

Code Handling

Your code is never
stored permanently.

When you connect a repository, we create an encrypted LUKS volume with an ephemeral key, then shallow clone (depth=1) into it. Even an operator with root access sees only ciphertext. After scanning, the volume is destroyed and the key is zeroed from memory. A scheduled cleanup job guarantees removal within 2 hours.

What we store
Security findings & file paths
CI/CD workflow structure
Dependency manifests
SAST results (SARIF metadata)
Source code files
Git history or commits
Binary files or build artifacts
Scan Lifecycle
ConnectRead-only token
EncryptLUKS ephemeral key
Clonedepth=1, encrypted vol
ExtractMetadata only
DeleteVolume destroyed
<2h
Max code lifetime
LUKS
Encrypted volumes
depth=1
Shallow clone only
Data Control

Your data,
your decision.

Full transparency into what we hold, what's currently checked out, and instant deletion when you disconnect. Every data operation is logged immutably.

Immediate cascade delete

Disconnecting a repo removes all findings, scans, facts, and evidence packs instantly. Nothing is retained after you disconnect.

Audit trail preserved

Every deletion event is logged immutably with record counts — how many findings, facts, and evidence packs were removed. Auditors can verify complete data removal.

Real-time visibility

View active checkouts in your dashboard, see encryption status for each, and watch the auto-delete countdown. You always know exactly what we hold.

Encryption

Per-org key
isolation.

Every organization gets its own encryption key, wrapped by a master key. Compromise of one org's data cannot expose another's credentials.

Integration tokensAES-256-GCM
Org encryption keysAES-256-GCM
API keysSHA-256
User passwordsbcrypt
Key Hierarchy
Master Key
Environment variable
Org Key
Per-org, encrypted in DB
Integration Tokens
GitHub, GitLab, Bitbucket

All communication encrypted in transit via TLS. Internal services use private networking — not exposed to the public internet.

Scanner Sandboxing

Every scanner runs
in a locked box.

External SAST tools execute inside isolated Docker containers with strict security constraints. Only SARIF output leaves the container.

--network none
Zero network access
--read-only
Read-only filesystem
--cap-drop ALL
No Linux capabilities
--no-new-privileges
No privilege escalation
/workspace:ro
Read-only repo mount
--tmpfs /tmp
Ephemeral scratch space
docker container
$ docker run \
--network none \
--read-only \
--cap-drop ALL \
--security-opt no-new-privileges \
--memory 2g --cpus 2 \
-v repo:/workspace:ro \
--tmpfs /tmp:rw,noexec,nosuid \
scanner --sarif /workspace
─────────────────────────────────
Output: SARIF only (no code leaves)
Cleanup: --rm (container auto-removed)
AI Agent Sandboxing

Credentials never
enter the container.

When AI agents generate code fixes, they run inside a hardened Docker container with complete network isolation. GitHub tokens and API keys are handled exclusively on the host — the container never sees them.

VCS tokens
Repo cloned on host, bind-mounted read-only. Push and PR creation happen on the host after the container exits. Token never enters the container.
LLM API key
Injected by a host-side network proxy. The container sends requests through a local socket; the proxy adds credentials server-side.
Environment
Processes receive a minimal, sanitized environment. No secrets or credentials are present inside the container.
--network none
Complete network isolation
--cap-drop ALL
No Linux capabilities
--read-only
Immutable root filesystem
--no-new-privileges
No privilege escalation
Network proxy
Only LLM provider endpoint allowed
Binary allowlist
Only approved tools can execute
Subcommand deny
Dangerous operations blocked
Shell operator reject
Pipes, backticks, $() denied
Branch validation
Prevents injection via git refs
Multi-stage build
No network utilities in runtime
Non-root user
Unprivileged, no sudo
256 PID limit
Fork bombs contained
Full Details

Everything else you
need to know.

Tenant Isolation

Every database table is scoped by orgId. All queries filter by the authenticated user's organization. No cross-org access is possible through the API. Each scan uses a unique temp directory.

Authentication

  • JWT — 4 hour lifetime + refresh
  • API Keys — SHA-256 hashed, revocable
  • Ephemeral — 72 hour max, demo use
  • RBAC — Owner, Admin, Member roles

Audit Logging

Every significant action logged immutably with timestamps, actor identity, and org scoping. Includes SHA-256 hashes for tamper detection. Events cannot be modified or deleted.

Infrastructure

  • API & Web — public HTTPS only
  • Worker — private, no public domain
  • Databases & caches — private network only

Data Retention

  • Code checkout — encrypted, deleted after scan (<2h max)
  • Facts & findings — while org active
  • Audit events — retained indefinitely
  • Repo disconnect — full cascade delete + audit log

Employee Access

Production database requires explicit authorization. Tokens encrypted at rest (AES-256-GCM) — no plaintext admin view. Per-org isolation means one org's key can never decrypt another's credentials.

Customer Transparency

  • Real-time view of active code checkouts
  • Audit trail of all data operations
  • Workspace scrub logging with duration
  • Repo disconnect cascade with record counts

Responsible Disclosure

Found a vulnerability? Report it to [email protected]. We acknowledge receipt within 48 hours and work with you on resolution.

Questions about
our security?

We're happy to walk through our architecture with your security team.

Schedule a ReviewGet Started Free