Security & trust

Every domain table carries a workspace_id and is isolated by Postgres row-level security — isolation is enforced by the database, not just application code. Cross-tenant access is impossible for a normal client even if app code has a bug.

Privileged operations use a service-role connection only inside trusted server code, which always scopes queries by workspace and performs its own role checks.

GitHub tokens, webhook signing secrets, and SCIM tokens live in a service-role-only table with row-level security that denies all client access — they are never readable from the browser and never appear in audit logs.

API keys are stored as SHA-256 hashes and shown exactly once at creation; we cannot recover the plaintext. Webhook deliveries are verified with an HMAC signature scoped to each workspace.

Accounts use Supabase Auth with email verification. Enterprises can enable SAML single sign-on and SCIM user provisioning. Roles (owner / admin / member / viewer) gate every privileged action.

All traffic is served over TLS. Data is encrypted at rest by our database and storage providers.

Sensitive actions — token changes, plan changes, member changes, scans — are recorded in an append-only audit log, visible to workspace admins.

VulnGraph runs on Vercel (application) and Supabase / Postgres (database, auth, storage) in the United States. Source code is fetched read-only for scanning and is not retained beyond what is needed to build your architecture graph.

We follow SOC 2-aligned practices (least privilege, audit logging, encryption, tenant isolation). We are not yet SOC 2 certified; if you need a security review or questionnaire, contact us.

Found a vulnerability? Email security@vulngraph.us. We will acknowledge your report, keep you updated, and credit you if you wish. Please give us reasonable time to remediate before public disclosure. See our security.txt.