Trust and help
Security and privacy
How Brunel handles your code, your credentials and your data. What it reads, keeps and never does, how accounts and secrets are protected, retention, and how to report a vulnerability.
What Brunel never does
- Execute your code. Repositories are read as files; nothing is installed, built or run.
- Hold cloud credentials. Deployment runs in your GitHub Actions with OIDC or your own GitHub secrets.
- Show or send secrets. Secret values found in a repository are redacted from what is stored and from what the AI sees.
- Let the AI decide numbers. Prices, service names, SKUs and Terraform come from catalogs and templates.
The life of a repository
- Downloaded read-only from GitHub into a temporary folder, with size limits and path checks.
- Read by deterministic detectors and the security check.
- Only detected facts and short, secret-free excerpts go to the AI provider, when AI is used at all, wrapped as untrusted data. The AI has no tools.
- The repository is deleted. Brunel keeps the facts, the architecture versions and the conversation.
Accounts and sessions
- Sign-in with GitHub (OAuth with state, PKCE and CSRF protection).
- A random 256-bit session secret in an encrypted
__Host-cookie; the server keeps only its hash, for 30 days at most, revocable per device or everywhere. - Sensitive changes (API keys, deletions, team security, deployments, certificates) need a sign-in from the last two hours.
- Each console address has its own session, opened through a one-time relay bound to your browser.
Secrets at rest
GitHub tokens, AI keys, single sign-on client secrets and webhook secrets are sealed with AES-256-GCM, bound to their owner, and never sent to the browser.
Web protections
A per-request Content Security Policy with nonces, HSTS with preload, same-origin checks on every change, SameSite cookies, strict isolation headers, and JSON-only APIs that download as files when opened in a browser. The API host accepts keys only and ignores cookies.
Retention
| Data | Kept |
|---|---|
| Repository files | Deleted right after analysis |
| Guest conversations | 30 days after their last activity |
| Sessions | 30 days at most (shorter with team rules) |
| API request logs | 30 days (daily aggregates 13 months) |
| Webhook deliveries | 30 days |
| Personal security activity | 90 days |
| Your account and projects | Until you delete them; export them any time from Profile and security |
Deleting your account deletes its data and revokes Brunel's grant on GitHub.
Supply chain
Container images are published with a GitHub build attestation, SLSA Build Level 3 provenance and an SBOM. Dependencies are audited in CI, updated by Dependabot and scanned by CodeQL. See Run Brunel yourself.
Report a vulnerability
Write to us through https://brunel.cloud/security. We read every report and fix confirmed issues first. Please do not test against other customers' data.