Security
Gondolier asks for a forge personal access token or OAuth token to operate your merge queue. Here's specifically how we protect it and the rest of your tenant data.
Credential protection
- Forge tokens are encrypted at rest with AES-256-GCM under a per-connection binding, so a ciphertext can't be moved to a different connection row and still decrypt.
- The encryption key is a versioned key held in Cloudflare Secrets, rotatable without re-enrolling every tenant.
- Tokens are never returned by the API, and are decrypted in memory only for the duration of a single queue operation — never logged, and never written to disk outside the encrypted database row.
This is strong encryption at rest with key rotation, not KMS-backed envelope encryption with a per-tenant data key. Moving the wrapping key to a managed KMS is a planned step before we represent this as such; see our public documentation for the current, precise description if that distinction matters for your evaluation.
Data isolation
- Database access is enforced with row-level security: every tenant-owned table denies anonymous and cross-tenant access at the database layer, not only in application code.
- A repository's forge connection is constrained to belong to the same tenant at the schema level.
Request integrity
- Forge and Stripe webhooks are verified by HMAC signature before any side effect — including deduplication — occurs.
- API requests are rate-limited, and cross-origin requests are restricted to an explicit allowlist.
Reporting a vulnerability
If you find a security issue, email gondolier@laputacloudco.com with what you found and how to reproduce it. We don't yet have a formal disclosure program or bounty, but we'll respond and work the issue with you.