Security

CIPatch is given read access to private CI data, so the security posture is deliberately narrow: least privilege, short-lived credentials, and no access to the things it does not need.

Design principles

• Least privilege, separately escalated. Installation grants read-only access. Write scopes are only used once you enable pull requests, and only ever for one file.
• Short-lived credentials. Installation tokens expire in an hour and are cached in memory. The App private key lives in the platform secret store, and is loaded into a base64 environment variable rather than a file on the host.
• No secrets, ever. CIPatch never reads repository secrets and never echoes environment values.
• No raw logs. Actions logs are out of scope by design; only metadata and workflow YAML are read.
• No customer data in logs. Operational logs carry identifiers and counts, not workflow content.
• Verified inbound only. Every webhook is authenticated before its body is parsed: HMAC for GitHub, and PayPal's own transmission verification for payments.
• Tenant isolation. The customer dashboard reads only the installations the signed-in GitHub account can already see, from a signed session. A request naming anything else is refused.
• Idempotent by construction. Webhook deliveries and payments are keyed, so a redelivery cannot double-ingest or double-charge.
• Automatic rollback of trust. A rule whose revert rate crosses a threshold is disabled rather than defended.

Data handling

• Stored: repository identifiers, workflow paths, run and job timings, proposals, outcomes, payments and audit records.
• Not stored: source code, secrets, raw logs, or card details. Card data never reaches CIPatch; checkout happens on the payment provider's hosted page.
• Workflow snapshots are used to compute a patch and are not retained as a copy of your repository.
• Uninstalling discards credentials immediately and marks the installation deleted.

Reporting a vulnerability

Use the contact form with the details and, if possible, a reproduction, or email security@releasedge.com. Please do not open a public issue. We acknowledge within two business days, and we will not pursue anyone who reports in good faith and avoids privacy violations, data destruction and service disruption.

Scope of this page

This describes the system as built, in plain language. It is not a certification and not a substitute for your own review. Enterprise security questionnaires and bespoke DPAs are out of scope for the self-service plans.