Security
A plain account of how this website and the data flowing through it are protected. For the CLI itself: it runs inside your own infrastructure, so your code and pipeline data never reach us.
Application security
- A Content-Security-Policy, HTTP Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options: DENY, Referrer-Policy, and a locked-down Permissions-Policy are set on every response.
- Rate limiting on authentication, the waitlist form, and the Oracle widget's API route, to slow down brute-force and abuse attempts.
- Origin-header verification (CSRF mitigation) on our API routes.
- Sign-in sessions use strictly-necessary, HttpOnly cookies that are never used for tracking or advertising.
Data handling
- All database queries go through Drizzle ORM with parameterized queries, no raw SQL string concatenation, so there is no SQL-injection surface in how we talk to our own database.
- Vercel Web Analytics on this site is cookieless: it sets no cookie and assigns no persistent visitor identifier.
- Full detail on what we collect and why, including every third party involved, is in our Privacy Policy.
Infrastructure
- This site is hosted on Vercel with HTTPS enforced end-to-end.
- Our database runs on Neon (managed Postgres).
- The Oracle widget and repo chat call Google's Gemini API server-side; your query text is never exposed to other visitors.
Certifications
- We have not pursued formal certifications such as SOC 2 or ISO 27001 yet. We would rather say that plainly than leave the question unanswered.
- In their place, the entire codebase, including everything described on this page, is AGPL-3.0-licensed and public on GitHub. You do not have to take our word for any of it.
Found a vulnerability?
Please do not report it in a public GitHub issue. Follow our security policy and email security@opencomplai.com. For the full data-handling picture, see the Privacy Policy.