Tenant authorization
Every dashboard mutation validates the signed-in user against the project workspace. Repository installations are verified against the GitHub user and cannot cross workspace boundaries.
Customer and owner permissions are separate
Widget sessions can read their own public conversations and submit messages from allowed origins. They cannot access notes, owner APIs, repository credentials, or engineering controls.
No arbitrary repository execution
Workers only read bounded GitHub source and propose restricted file replacements. Environment files, keys, dependencies and CI workflows are excluded from patch scope.
Limits and evidence
Redis rate limits, transactional token reservations, monthly job limits, signed webhook verification, and audit records constrain and record actions. We do not claim SOC 2 or regulatory certification.