OPERATE
Security model
Understand defense-in-depth controls across identity, data and operations.
Last updated July 19, 2026 · 6 min read#Security principles
- Tenant isolation at gateway, service and persistence layers
- Least privilege through granular permissions and entitlements
- Encryption in transit and at rest with managed key rotation
- Tamper-evident audit for sensitive reads and all mutations
- Fail-closed verification for signed callbacks and provider events
#Secrets and keys
Production credentials belong in the configured secret manager, never manifests or environment files committed to source control. Rotation procedures cover API keys, database credentials, certificates, webhook secrets and signing keys.
#Report a vulnerability
Coordinated disclosure
Use the security contact in SECURITY.md. Do not submit sensitive findings through public issue trackers.
Was this page helpful?