Security

You are trusting us with your source code. That trust is the whole business — here is how we protect it.

Platform

• Encryption in transit — HTTPS everywhere with auto-renewed certificates; Git over SSH available on production.
• Isolation — the database is on a private network with TLS (verify-full); the Git engine runs in an isolated container.
• Private by default — new repositories are visible only to you until you decide otherwise.
• Backups — off-site, encrypted, and restore-tested. A backup that has never been restored is a rumour, not a backup.

Accounts

• Passwords stored using modern hashing; a strength checklist at sign-up.
• Two-factor authentication (TOTP) and SSH-key auth supported.
• Google sign-in available, so you can rely on your existing account security.

CI/CD (when it launches)

Runners execute untrusted code by definition, so they will be ephemeral and isolated — fresh environment per job, destroyed after, with no access to other tenants' work.

Reporting a vulnerability

Found something? Please email AJAYA@laabamone.com with details and steps to reproduce. We commit to acknowledging reports within 48 hours, and we will never take legal action against good-faith research.