Security / built on clear boundaries
Security at
CodeStax
Full repository checkouts are processed ephemerally. Source-derived review evidence can be retained, sensitive credentials are encrypted, and optional AI processing follows the organization's selected provider policy and contract.
CodeStax / data lifecycleIllustration
Your repositoryConfigured provider access
Isolated scan workspaceCheckout removed after processing
Review evidenceRetained under product controls
Code processing
- Full repository checkouts use isolated scan workspaces and are removed after processing
- PR review attempts retain changed-file names and unified diff patches to render historical evidence
- Findings, summaries, review evidence, and source-derived records are tenant-scoped and retained under product controls
- When PR-review AI is enabled, bounded context is sent only to the provider selected by the effective policy and remains subject to that provider contract
Encryption
- Public platform traffic is protected in transit with HTTPS
- Sensitive data (OAuth tokens, API keys) encrypted at rest
- Stored credentials encrypted at rest
- Traffic between internal platform services travels over an encrypted private network
Authentication and access
- Configurable OAuth providers for supported source-control and identity platforms
- Role-based access control: Owner, Admin, Member, Viewer
- Organization-level tenant isolation on every database query
- API key authentication with per-key scoping and rotation
- Server-verified sessions with role and active-user checks
Infrastructure
- Internal service-to-service traffic is encrypted on a private network that is not reachable from the internet
- Scans run on isolated scanner hosts, separate from the web application; repository fetches, package lookups, vulnerability intelligence, and configured AI provider calls stay with scan workloads
- Repository workspaces are removed after each scan; retained results and PR evidence use the platform data stores
- Rate limiting on public and API endpoints
- TLS on every public endpoint, with certificates renewed automatically
- The platform database is backed up every night; a copy is kept on a second server over the encrypted private network, and backups are retained for 14 days
Monitoring and audit
- Customer-visible audit events are recorded for implemented auth, API key, repository, scan, triage, settings, billing, compliance, and PR-review actions
- Scan execution and operational health are visible in product and admin views
- Structured operational logs use request or correlation metadata where implemented; credential and prompt values are not intentionally logged
- Operational logs and status views support investigation of security-relevant failures
Compliance
- SOC 2 Type II is on our roadmap
- GDPR data-subject controls: export, deletion (30-day grace period), and anonymization
- CCPA data-subject controls: right to know, right to delete, no data sales
- Essential cookies only inside the signed-in product. On public pages, signup and onboarding, an optional advertising cookie loads only if you choose "Accept all" (cookie details)
- Scan-data retention follows plan limits or configured organization SCA retention policies where enabled
- Compliance reports (SOC 2, ISO 27001, OWASP, PCI DSS) generated from your scan data
Vulnerability disclosure
Found a security issue? Tell us.
We welcome reports from security researchers and customers. Email security@codestax.co with the affected URL or endpoint, steps to reproduce, and the impact you observed. Our machine-readable contact details are published at /.well-known/security.txt.
What we commit to
- We acknowledge every report within five business days and tell you who is handling it
- We keep you informed while we investigate and when a fix ships
- Confirmed issues are prioritised by severity and exploitability, the same way the product ranks findings
- We credit you publicly if you want credit, and we do not share your details otherwise
Safe harbour
- Research conducted in good faith under this policy is authorised; we will not pursue legal action against you for it
- Only test against accounts and data you own or are authorised to use; never access, modify or delete another customer’s data
- No denial of service, spam, social engineering of staff or customers, or physical attacks
- Stop and report as soon as you can demonstrate the issue; do not exfiltrate data beyond what is needed to prove it
In scope: codestax.co, admin.codestax.co, docs.codestax.co and the API under codestax.co/api. Out of scope: findings that only affect third-party services we integrate with, missing best-practice headers without a demonstrated impact, and automated-scanner output without a working proof of concept. There is no paid bounty programme at this time.
Have security questions?
Reach out to our security team at security@codestax.co or request a security overview.