Security

Where we are

The controls below are in place today. The ones that are not, are named as such. A trust page that lists only what is finished is a marketing page.

Protecting your code

• It is not training data. Your code is never used to train any model. Where a feature must send content to a model provider, it goes under terms that prohibit training on it.
• Most analysis never leaves our systems. Graph assembly, drift detection, contract checks, the health scan and the security rule pack are deterministic code. They contact no model provider at all.
• You can bring your own model provider, on any plan. An Anthropic key, an Amazon Bedrock role, OpenRouter, or any endpoint that speaks the OpenAI protocol (including a corporate gateway or a server you host), with your own address and your own model names. Yours is used before ours for your work, so the model terms that apply are the ones you already signed. Credentials are encrypted at rest, never returned to the browser, and removable at any time.
• Photographs are read by a deterministic scanner first. The image is uploaded to us, and read by ordinary offline code: shapes, arrows and text, no model provider involved. Only where that read fails is it sent to a vision model, and we say so in the result. If a photograph is too sensitive to upload at all, draw on the canvas instead: that path sends coordinates, never a picture.
• Staff access is exceptional and logged. Support you requested, or legal compulsion. Never routine browsing.
• Deletion is real. Immediate from live systems, within 30 days from backups.

Infrastructure

• Managed cloud infrastructure with encrypted storage and automated backups.
• Secrets in a managed secret store, never in source control, never in logs.
• Tenant scoping enforced at the data-access layer and asserted by tests, so a missing filter fails a build rather than a code review.
• Structured audit logging on privileged operations.

Agent execution

An agent that writes code is a security boundary, and we treat it as one.

• Runs are isolated per project. One run cannot see another project's workspace.
• Scope is enforced, not requested. A build task may only modify the files its own graph nodes own. Reaching outside that allowlist fails the run. It does not quietly succeed.
• Credentials are never handed to the agent. Where a run needs a third-party token, it is substituted outside the execution sandbox, so agent-written code cannot read or exfiltrate it.
• Every change is attributable and reversible: to a task, to a node, to a commit.

Reporting a vulnerability

If you find a security issue, please tell us before telling anyone else. Email prin@cipher.academy with the subject line “Security”, and include enough detail to reproduce it.

• We acknowledge within 24 hours.
• We give an initial assessment within 5 working days.
• We keep you updated until it is resolved, and tell you when it ships.
• We will credit you publicly unless you prefer we did not.
• We will not pursue legal action against research conducted in good faith within the scope below.

We do not run a paid bounty programme yet. When we do, it will be announced here.

Scope

In scope

• This website and its form endpoints.
• The product web application and its API.
• Authentication, authorisation, and anything that crosses a tenant boundary.
• Anything that escapes the build sandbox or the file allowlist.

Out of scope

• Denial of service, volumetric or resource-exhaustion testing.
• Social engineering of our team, our users, or our vendors.
• Findings from automated scanners with no demonstrated impact.
• Missing hardening headers with no exploitable consequence.
• Vulnerabilities in third-party services. Please report those to their owners.

Please use test accounts and your own data. Do not access, modify or retain anyone else's, and stop as soon as you have proven the issue.