Security at Rimenoa

Rimenoa is built as a multi-tenant SaaS with workspace isolation enforced at the query layer, role-based access control, and a full audit trail on every administrative action.

• GitHub App access is least-privilege and read-only on source repositories.
• Webhooks are HMAC-SHA256 verified with replay protection.
• Agent telemetry tokens are stored as SHA-256 hashes and scoped per workspace.
• Secrets live in the deployment platform's secret store — never in the database or code.
• AI analysis treats all repository content as untrusted input; the outcome resolver has no shell access and no write access to GitHub.

To report a vulnerability, contact the workspace operator or open a private security advisory. Full details live in the project's SECURITY documentation.