security_architecture
security.yaml
# A detailed outline of GitMesh's data protection ciphers, tenant partition policies, and zero-retention infrastructure rules.
# Select a security file tab to inspect specifications:
Every FastAPI route is protected by token signature verification. We validate Supabase-issued JWTs using HS256 encryption against the server-side private secret.
Security Specifications
- Signature Verification: Every request extracts the Bearer token and decodes it using the SUPABASE_JWT_SECRET.
- Audience Constraint: Checks the audience claim (aud) to equal 'authenticated', blocking foreign token recycling.
- Role Validation: Validates user context UUID and role parameters.
Supabase JWT Auth
Every FastAPI route is protected by token signature verification. We validate Supabase-issued JWTs using HS256 encryption against the server-side private secret.
Security Specifications
- Signature Verification: Every request extracts the Bearer token and decodes it using the SUPABASE_JWT_SECRET.
- Audience Constraint: Checks the audience claim (aud) to equal 'authenticated', blocking foreign token recycling.
- Role Validation: Validates user context UUID and role parameters.
common_queries
Security & Privacy FAQ
Do you store my GitHub password or tokens?
No. GitMesh uses standard OAuth2 secure checkouts to fetch files. Your credentials are processed transiently in temporary memory or securely managed by GitHub during authentication.
Is my codebase content cached or stored?
Only abstract graph maps (classes, function names, and import connections) and raw outlines are persisted inside your tenant space on Supabase. Full file contents are cloned to volatile disk, processed, and completely deleted instantly. We never keep copy caches of your source files.
Can other users see my parsed repositories?
No. PostgreSQL row-level checks and secure tenant validation parameters enforce complete workspace isolation. Users can only query repositories associated directly with their unique Supabase authenticated account sub UUID.
What happens when I delete a repository?
Deleting a repository triggers an immediate purge. All DB files metadata, graph linkages, and cached diagrams are deleted in an atomic transaction from our active tables.