Security

repod is built for GitHub organization metadata and access-control operations. It does not clone repositories or process source code contents in normal operation.

More specifically, the normal service path does not retrieve repository contents, analyse source files, read commit diffs, ingest issue or pull-request body text, collect Actions logs, or store build artifacts.

Access Model

repod supports PAT auth and GitHub App beta. For PAT auth, repod only accepts fine-grained GitHub personal access tokens beginning with github_pat_ for new connections, token rotation, and public access audits. GitHub App beta stores encrypted app credentials and mints short-lived installation tokens when needed.

• Audit/read mode: uses read-oriented access to organization settings, repository metadata, members, teams, direct collaborator access, and repo-team permission state.
• Write mode: is only needed when a customer asks repod to apply repo-team permission changes, repository metadata changes, repository renames, or team-management changes.
• Customer control: customers can rotate or revoke GitHub tokens, GitHub App private keys, or GitHub App installations at any time from GitHub. repod sync and apply operations pause until valid credentials are restored.

Permission boundary: repod's core sync, reporting, repo-to-team apply, and repository metadata workflows do not require Repository Contents permission or Organization Members write. Under GitHub's permission model, private repository contents require Repository Contents read, while organization invitations require Organization Members write. Optional Team management is a separate elevated mode requiring Members write; do not enable it if organization-invitation capability must be impossible from the repod GitHub credential. Repository Administration write can add or remove repository collaborators, which is direct repository access rather than GitHub organization membership.

Data Handled

• Account and authentication records, including email addresses and password hashes.
• GitHub organization metadata, repository names and metadata, teams, team descriptions, members, direct collaborator access, and permission history.
• GitHub credential configuration, including encrypted PATs or encrypted GitHub App private keys and installation metadata.
• Audit logs for access changes, org lifecycle events, and security-relevant account activity.
• Operational telemetry and logs that exclude plaintext PAT values, GitHub App private keys, and installation tokens.

Credential Protection

GitHub PATs and GitHub App private keys are encrypted at rest and are decrypted only in process when repod calls GitHub APIs. GitHub App installation tokens are short-lived. Plaintext PATs, GitHub App private keys, and installation tokens are not written to application logs or audit details.

Customer-Side GitHub Credential Risk

repod cannot prevent a malicious IDE extension, compromised laptop, browser extension, stolen GitHub session, or stolen user PAT from abusing the GitHub access that credential already has. Treat that as a separate endpoint and identity risk.

Where repod helps is blast-radius review: showing who can reach which repositories, which repositories are broadly exposed, where direct grants exist, and where access has drifted from the intended team model.

Tenant Isolation And Roles

Domain data is account-scoped. Users receive account roles such as owner, admin, maintainer, viewer, or audit, and those roles map to application capabilities for org management, reporting, member management, and write operations.

Auditability

Material org lifecycle and security events create audit entries. Access changes are designed to be previewed before apply and then recorded after execution.

Retention And Backups

Org-history and audit data are retained while an account is active, subject to the retention periods described in the Privacy Policy. The configured org-history retention sweep is 180 days by default. Customers can request deletion through support@repod.dev. Deleted live-service data may remain in protected backups until backup expiry and is restored only for disaster recovery, security, or legal reasons.

Incident Response

Security incidents are triaged by severity, contained, investigated, and recorded. If Data Demon becomes aware of a personal data breach affecting customer processor data, Data Demon will notify the affected customer without undue delay under the DPA and provide reasonable information as investigation progresses.

Compliance Status

repod does not currently hold SOC 2, ISO 27001, or Cyber Essentials accreditation. Formal attestations are planned for a later stage; this page documents the current security posture, controls, and operating model.

Security Contact

Report security issues to support@repod.dev. See the Vulnerability Disclosure page for reporting guidance, or review our Subprocessors page.

Buyer Trust Pack

For a concise buyer-facing summary of the security model, see the repod Trust Pack. For processor terms, see the Data Processing Addendum.