Security and access

Connecting a repository records its name, its branch and one commit. That is all connecting does.

Not yet verified with live repository accounts.

Reading files, sending files to a model, staging changes, running checks and releasing each need a separate owner grant.

Only an owner of the organization that owns a repository can connect it or grant access. The vendor cannot grant access to the customer's repository.

Not yet tested with live accounts.

Withdrawing a grant stops new work. Attune does not repeat an action whose outcome is unknown.

Tested with synthetic data.

The GitHub App asks for two permissions: repository contents (read) and metadata (read).

Attune refuses an installation or token with more permissions than those two.

Attune does not push branches, write to your repository or open pull requests.

This is the current design. A pull-request option may come later.

To connect an installation, the person must be an admin of every repository it exposes.

Each task gets a short-lived, read-only token for one repository.

Revoke access in Attune stops Attune's use of the installation. It does not uninstall the App on GitHub.

Local execution uses Docker containers with a read-only root file system, all capabilities dropped, no-new-privileges, an unprivileged user, CPU, memory and process limits, and a pinned image. The execution method determines whether containers have no network or a per-run internal network.

Local development sandbox. Not a production isolation guarantee. Limits are not stress-tested.

No file goes to an AI model until an owner approves it for that task. Approved text goes to Anthropic's Claude.

Development setup. No production model-provider agreement yet. Attune cannot erase text that a model provider already received.

Approvals bind to an exact version. A changed brief, plan or package makes old approvals historical.

Attune computes pass or fail from the check results. The implementation agent cannot mark its own work as passed.

Authorized reviewers can inspect the proposed change and its acceptance-check results for the exact code revision.

A person authorizes each exact release. Customer acceptance is a separate decision.

Synthetic release target.

The customer's environment owner approves each exact deployment preview and can stop it.

Available in the local build with synthetic data. Not yet verified in a real customer environment.

Delete removes a resource's text from Attune's database, from shared copies and from exact quotes in generated text. Until every reachable copy is gone, the result says "Partly erased from Attune" and names what Attune cannot reach.

Delete does not reach backups, text a model provider already received, execution records that require an Attune operator to purge them, or some protected history records. The deletion result identifies records Attune cannot remove. A removal record retains the resource title, a hash, who deleted it and when.

No SOC 2, ISO 27001 or other certification or third-party audit.

No penetration test.

Per-resource encryption keys are designed and partly built. They are not in use.

No production deployment and no customer data.

The development build supports local account sign-in. Sign-in through Clerk is not yet verified with live accounts.

Security contact to confirm.