Security at gitroots.
Protecting who can touch your code is our product. Here’s how we protect gitroots itself.
Least privilege by design
gitroots narrows access to the repositories, branches and actions each developer needs.
Provider-based repositories
Connected Git providers continue to host the repositories that gitroots governs and synchronizes.
Audit history
Governance activity records the actor, action, target, result and time for review by workspace administrators.
Authentication controls
Accounts use protected sign-in flows, with GitHub connection authorization handled separately for each workspace.
Protected credentials
Connection credentials are kept server-side and are never exposed in the browser or public API responses.
Managed infrastructure
Production services and databases run in managed cloud infrastructure with access limited to operational needs.
Role-based administration
Workspace roles separate everyday development access from policy, membership and approval administration.
Security review
Contact our team for current security documentation and answers to your organization’s review questions.
Found a vulnerability?
Tell us privately and give us a reasonable time to fix it before sharing it publicly. We won’t take legal action against good-faith research that follows these guidelines.
- Email [email protected] with steps to reproduce, the impact, and any proof of concept.
- Don’t access, change or delete data that isn’t yours.
- Don’t run tests that degrade the service for other customers.