legal · updated 2026-10-18

security

diff social holds code and the conversations about it, so it is built to keep each tenant’s rooms to that tenant and to ask for no more access than it needs. This page says how, as the service runs today.

tenants are kept apart by the database

  • Every room belongs to a tenant, and the database enforces it with row-level security, forced even for the tables’ owner. A query that forgot its tenant would still see nothing of another’s.
  • Rooms open only to the members of their tenant, with what their role allows: viewers read, members take part, admins manage.
  • Private code opens only when three things agree: you are signed in, your own GitHub account may read the repository, and your tenant has claimed the GitHub App installation that covers it.

access

  • Sign-in is handled by WorkOS, with Google or GitHub. We never see or store your password.
  • Your session is a random token in an HttpOnly, Secure cookie. We store only its hash, so a copy of our database opens no one’s session. Signing out ends it at WorkOS too.
  • The GitHub App asks only to read repository contents and metadata. Your GitHub tokens are encrypted with a key kept apart from the database, and never reach your browser.
  • Service tokens for automation are scoped, expire (within a year, when made on the web), are stored as hashes, and can be revoked by the tenant’s admins at any time.

data

  • Every connection to the service is encrypted with TLS, and the database accepts only encrypted connections.
  • Data is stored on Google Cloud in the United States (us-central1), encrypted at rest.
  • The database is backed up daily, 14 backups are kept, and it can be restored to any point in the last 7 days.
  • Secrets are kept in Google Secret Manager. Deploys use short-lived, keyless credentials; no long-lived cloud keys exist in our build system.
  • Who processes what, and for how long, is in the privacy policy.

payments

Card payments happen on Stripe’s pages. Card numbers never reach our servers; we keep only a tenant’s plan, seats and Stripe ids. Stripe’s webhooks are verified by signature, and a subscription’s state is always read back from Stripe before it changes a plan.

what reaches us from outside

  • Webhooks from GitHub, WorkOS and Stripe are accepted only with a valid signature; WorkOS and Stripe also sign the time, and a stale delivery is refused.
  • Agents a tenant adds can reach public addresses only, never our internal network.
  • Every address has request and connection limits, every tenant a monthly budget for model work, and the whole service a monthly ceiling.

how releases are made

  • Every change runs our tests, a dependency audit and a scan of the whole history for leaked secrets before it can ship.
  • Release images are built in CI from the tested commit, signed with Sigstore cosign, and carry a software bill of materials and build provenance.
  • Third-party build steps are pinned to exact versions by their commit, and dependency updates arrive as reviewed pull requests.
  • Deploys check that the new version answers its health check, and roll back by themselves if it does not.

reporting a vulnerability

If you find a security problem, write to dj@codetestcode.io with the details and how to reproduce it. We acknowledge reports within 3 business days and keep you told until it is fixed. We will not take legal action against research done in good faith that respects others’ data and privacy, avoids disrupting the service, and gives us reasonable time to fix a problem before it is made public. Our contact details are also in security.txt.