Trust & Security at GoBananas

Our Approach

GoBananas generates, stores, and runs code on behalf of our customers. That puts us in a privileged position, and we take it seriously. Our security programme is grounded in three principles: defaults are secure, least privilege is the norm, and isolation is enforced at the platform layer, not left to individual features.

We're a small team shipping quickly, and we won't pretend to have enterprise compliance artefacts we haven't earned yet. What we do commit to is being honest about where we are, moving fast on critical issues, and giving security researchers a clear path to reach us.

Below is a snapshot of our current posture, followed by what we're actively shipping, who we share data with, and how to reach our security team.

Compliance Status

What We Do Today

• Encryption in transit and at rest. All traffic runs over TLS (managed by Cloudflare and Railway). Postgres volumes are encrypted at rest by our managed hosting provider.
• GitHub App installation tokens, not long-lived secrets. We integrate with user repositories via GitHub App installations so we never store your personal access token or OAuth refresh token for code access.
• Per-tenant data isolation. Each project lives in its own filesystem worktree. Collaborators work in isolated per-user git worktrees with separate chat histories and build sessions.
• Server-side WebSocket authorisation. Following a recent P0 fix, every WebSocket room join is checked server-side against project membership and share-link validity — no client-declared claims are trusted.
• Open-source dependency tracking. We track our npm dependency tree for known advisories and update proactively.
• Principle-of-least-privilege database access. The application connects to Postgres with a scoped role. Admin operations require a separate, short-lived connection.
• Access review for production. Production credentials are held by the founder and a short, named list of contributors. Access is reviewed when anyone joins or leaves.

What We're Shipping

Our near-term security and compliance roadmap — tracked against the Enterprise Readiness plan. Dates are targets, not guarantees.

• SSO (SAML 2.0 + OIDC). Enterprise-grade sign-in for Okta, Azure AD, Google Workspace, and generic OIDC providers. — Targeting Q1 2027.
• Per-project audit log. Append-only, exportable record of who-did-what across every project. — Targeting Q1 2027.
• Postgres Row-Level Security. Tenant isolation enforced at the database layer rather than application code alone. — Targeting Q1 2027, before SOC 2 observation window opens.
• Public status page + SLA tier. Real-time uptime, incident history, and a published SLA. — Targeting Q2 2027.
• SCIM 2.0 user provisioning. Automated user lifecycle management for SSO-enabled orgs. — Targeting Q3 2027, after SSO ships.
• Self-serve GDPR endpoints. Data export and erasure available in-product, no ticket required. — Targeting Q2 2027.

Reporting Security Issues

If you believe you've found a security vulnerability in GoBananas, please email [email protected]. We acknowledge good-faith reports within 48 hours.

Our full disclosure policy, scope definitions, and safe-harbor terms for researchers are published in our SECURITY.md.

Machine-readable contact info per RFC 9116: /.well-known/security.txt.

Sub-processors

The third-party services we rely on to operate GoBananas. We update this list when we add or remove a sub-processor.