Security

Your code is read, not kept

EnsureFix needs your repository to do its job and needs your credentials to push the result. Everything below is how those two facts are contained.

Request a demoRead the DPA
acme/payments · run lifecycle
  1. Cloneephemeral diskA shallow clone lands in a workspace created for this run only.
  2. WorkmemoryRanked context goes to the model. Agents plan, write, review and scan.
  3. Pushyour forgeA branch and a pull request go back to your forge over TLS.
  4. Destroynothing leftThe workspace is torn down. Metadata and the audit trail remain.

Source code is never written to an EnsureFix database, cache or backup.

AES-256

Credentials at rest, GCM mode

TLS 1.2+

Every connection in transit

7 yr

Tamper-evident audit retention

Zero

Source files stored at rest

The boundary

What crosses, and what comes back

A run is a loan, not a transfer. Context goes out for as long as the work takes; a branch comes back; the workspace that held the code stops existing.

Leaves your infrastructure

Ranked file context for the change being made, and the ticket text. Held in memory for the duration of the run.

Comes back to you

A branch, a pull request with the reasoning trace attached, and the scan and test results behind it.

Never persists anywhere

Source files, clones, build artefacts and the workspace itself. Nothing survives the run.

Defence in depth

Six control domains

No single control is load-bearing. Each domain below assumes the one before it has already failed.

01

Encryption

Credentials are the most valuable thing the deployment holds, so they are the most heavily protected.

In transit
TLS 1.2+ between the browser, your deployment and every third-party service it calls.
VCS credentials at rest
AES-256-GCM with a unique initialisation vector per entry.
Passwords
bcrypt at a cost factor of 12. Never reversible, never logged.
Key handling
Encryption keys live in your deployment's secrets, apart from the database, and a rotation tool re-encrypts every tenant database atomically when you rotate.

02

Authentication and access

One compromised session should never become access to a second organisation's data.

Session tokens
JWT in HttpOnly, Secure, SameSite=Lax cookies, expiring after 24 hours. Lax rather than Strict so an SSO redirect still carries the session; origin is checked per request.
Revocation
Logging out invalidates the session server-side immediately.
Roles
viewer, developer, admin and platform_admin, each with granular permissions.
Organisation isolation
Every data query is scoped by organisation ID. There is no cross-tenant read path.
Lockout
Automatic account lockout after repeated failed sign-in attempts.

03

Application security

The scanners EnsureFix runs against your code are the same class of checks we hold ourselves to.

SQL injection
Every database query uses parameterised prepared statements.
SSRF
Server-side fetching blocks RFC 1918, link-local and loopback ranges, and allowlists known VCS domains.
Command injection
Subprocesses are called with argument arrays, never an interpolated shell string.
XSS
React's default JSX escaping, with no unsanitised HTML injection paths.
Rate limiting
API endpoints are rate-limited per user and per IP on a sliding window.
Error handling
Responses carry generic messages; internal detail is logged server-side only.

04

Audit logging

An autonomous agent that touches production code has to be answerable for every action it took.

What is recorded
Sign-ins, permission changes, plan approvals and commits, in an immutable log.
Tamper evidence
Entries are chained with SHA-256 hashes, so any modification is detectable.
Write protection
Database triggers block UPDATE and DELETE against audit records.
Retention
Purges enforce a 90-day minimum floor, so retention can be lengthened for your policy but never silently shortened below it.

05

Webhook security

A webhook is an unauthenticated door into the pipeline unless every delivery is proven.

GitHub
HMAC-SHA256 signature validation on every delivery.
GitLab
Verified against the X-Gitlab-Token header.
Replay protection
Deliveries are deduplicated by delivery ID and payload hash.
Routing
Repository registration decides the organisation. There is no default fallback.

06

AI processing

The model provider is part of your supply chain — and in a self-hosted deployment, it is your account and your contract with them.

Transport
Code reaches the provider you configure over encrypted connections, using your own credentials.
Training
EnsureFix does not train on your code. What your provider may do is governed by the terms of your account with them, which is yours to review.
Validation
Generated code passes plan-quality checks, post-generation validation and a confidence-based decision engine before anyone sees it.
Human gate
High-risk fixes require an explicit human acknowledgement before they can be committed.

Where it runs

Inside your perimeter, and what crosses it

EnsureFix is deployed on your own infrastructure. That settles most of this page — but not all of it, and the part it does not settle is the part worth reading.

Stays inside your network

Every component runs on your servers: the dashboard, the worker, and every database. Repository clones happen inside your perimeter and the working directories are yours.

  • Databases, audit logs and evidence
  • Repository clones and workspaces
  • VCS and model credentials, encrypted at rest
  • Licence and trial state — verified locally

Crosses it, because you configured it

The work needs a model and a forge. EnsureFix calls the AI provider and the VCS you configure, using credentials you own, and that traffic carries the code being worked on.

  • Outbound HTTPS to your AI provider
  • Outbound HTTPS to your VCS
  • Nothing to EnsureFix — no telemetry requirement
  • No licence server to reach, ever

Most vendors imply the left-hand column is the whole story. It is not, for anyone, and a security review finds that out eventually — so it is on the page instead. The full deployment picture is in self-hosted deployment.

Questions

What reviewers ask first

The six questions that come up in every vendor assessment, answered without hedging.

No, and not as a policy — as an architecture. EnsureFix runs on your servers, so repository clones, working directories and every database are inside your network. We have no copy, no credentials of yours, and no route in. Within your own deployment, a run clones into a workspace created for that run and the workspace is destroyed afterwards; what persists is run metadata, file paths, decisions, timings and the audit trail.

found something

Responsible disclosure

Found something? Report it to security@ensurefix.com. We acknowledge receipt within two business days and keep you posted through remediation. Please give us reasonable time to ship a fix before disclosing publicly.

Email the security team

The rest of the paperwork

Bring it to your security review

Run it on your own repository

We will walk your team through the boundary, the audit trail and the self-hosted path on a live run.

Request a demoTalk to us