Security

Credential storage

Provider access tokens are encrypted with AES-256-GCM in a dedicated table, separate from the connection metadata that references them — a leaked or over-broad database read of the connections table cannot expose a token. Encryption is bound to the specific builder and provider it was issued for, so a copied ciphertext cannot be decrypted under a different owner.

Sessions

Sessions are stored server-side, not as self-contained tokens. Signing out or deleting your account revokes access immediately — there is no separate long-lived token that keeps working after that.

What we never do

• Fetch, clone, or index repository source code, under any connected provider.
• Log a provider token, a session identifier, or a raw provider response body.
• Publish anything without an explicit action from you — importing and syncing never change visibility.
• Sell placement in a ranking. Paid placements are structurally unable to write to vote counts, evidence scores, or search ranking.

Reporting a problem

If you believe a Passport is impersonating you, or you have found a security issue, use the report link on the affected profile, or contact the address on the homepage for anything more sensitive.