Security and trust

How code and accounts are stored, who can reach them, and how to report a problem.

Where things live

• Code is stored in Git on Cloudflare: Cloudflare Artifacts, or our own Git storage on Cloudflare R2. Each project's code is separate from every other project's.
• Accounts are in a Cloudflare D1 database: your GitHub login, name, picture and email, your teams, and your sessions. GitHub access tokens are encrypted before they are stored, and are only read on the server.
• History, merge records and audit events are kept per project and per team.

Who can reach what

• Projects belong to teams. Owners and admins run a team; members see the projects their team gives them.
• Tokens are scoped: an admin token for a project, a workspace token that writes only its own workspace, and agent group tokens that hand each agent its own workspace. Checks and sandboxes never hold a credential.
• A signed-in session works only from Switchyard's own pages. Changes made with a session must come from those pages.

Sign-in

• Sign-in is with GitHub. During the private beta only approved accounts can sign up.
• Sessions are signed with a key the database does not hold, so a copy of the database alone signs nobody in. Session cookies are Secure, HttpOnly and SameSite=Lax.
• Your account page lists where you are signed in. You can sign out one place, or everywhere, including yard in terminals.
• You can delete your account from the account page. You leave every team; a team only you are in, with no projects, is deleted with you. If you are the only owner of a team others are in, or of one that owns projects, hand it over first.

Evidence

• Every sensitive action is in your team's audit log for 400 days, and can be exported.
• Every merge has a merge record of what merged, why it was allowed, and which checks passed. Commits are signed on each agent's behalf.

Who processes your data

Reporting a problem

If you find a security problem, please tell us privately before telling anyone else, and give us a reasonable time to fix it. Write to security@switch-yard.dev.