Security & Compliance
Last updated: May 8, 2026
Access controls
Role-based access controls are enforced at API boundaries with workspace-aware authorization checks. Session and bearer-token flows validate issuer, audience, and expiration to reduce token abuse risk.
Data protection
Secrets and keys are stored encrypted at rest; API keys are persisted as hashes and never retrievable in plaintext. Sensitive mutating routes apply same-origin checks and hardened request validation.
Pipeline governance and change safety
PipelineSpec v1 introduces stable node identity, semantic diff checks, architecture invariants, and constrained patch scopes to keep high-change systems safe and reviewable.
Integration hardening
Webhook receivers verify signed timestamped payloads with replay windows. Outbound integration paths apply SSRF protections, host validation, and rate controls for abuse prevention.
Reliability controls
Metering idempotency, replay queues, webhook dedupe, and reconciliation checks are built into the production workflow.
Continuous security verification
CI pipelines include static analysis, dependency review, secret scanning, and regression tests to detect security drift before release.