Security

Two-tier execution

The API server receives verification requests, authenticates the caller, and enqueues a job. It never executes user-submitted code. Gates run in a separate secretless worker whose environment is allowlisted to exactly four keys; it executes in an ephemeral directory, writes a verdict, and exits. No production secrets reach the worker.

Zero code retention

The temporary directory holding a submitted diff is removed in a finally block after every job, success or failure. Submitted code is never persisted, never fed to an LLM, never used for training, and never shared with third parties.

Authentication

• Sessions: JWT signed with HMAC-SHA256, with a CSRF token bound to a double-submit cookie.
• API keys: HMAC-signed, self-contained, scoped to the issuing identity.
• OAuth: authorization code flow with PKCE and a state cookie; sessions mint only after a verified email.
• Provider key entry: restricted to an explicit owner allowlist and fails closed when unset.

Rate limiting

Per-IP and per-authenticated-identity windows apply, with a stricter registration window. Oversized payloads are rejected before parsing. Limits return HTTP 429.

Supply chain

Every release ships a SHA256SUMS manifest; the installer verifies checksums before executing anything downloaded. Dependencies are pinned via package-lock.json.

Reporting a vulnerability

Report issues to security@asondy.com. We acknowledge receipt within 72 hours and aim for a fix or mitigation plan within 90 days of a confirmed report. Please do not open public issues for vulnerabilities.