Security Policy

Security is at the core of everything we build at Branqo. We take the protection of your data seriously and have implemented industry-standard security measures across our application, infrastructure, and processes. This page describes our security practices and how you can report vulnerabilities.

Responsible Disclosure Program

We believe security researchers play a vital role in keeping our users safe. If you discover a security vulnerability in Branqo, we encourage you to report it responsibly.

Our Commitment to Researchers

We will keep you informed of our progress and will credit you (with your permission) when the fix is released. We will not take legal action against security researchers who act in good faith and follow responsible disclosure practices.

Security Measures

Transport Security

All communications between the Branqo desktop application, our API servers, and the website are encrypted using TLS 1.3 with modern cipher suites. We enforce HTTPS on all endpoints and use HSTS headers with a minimum age of one year.

Authentication & Session Management

• Password hashing: All passwords are hashed using Argon2id with per-user salts. We never store plaintext passwords.
• JWT tokens: We use short-lived JSON Web Tokens (15-minute expiry) with secure refresh token rotation. Tokens are signed using RS256.
• Rate limiting: Authentication endpoints are rate-limited to prevent brute-force attacks. Repeated failed login attempts trigger temporary account lockouts.
• OAuth: We support GitHub and Google OAuth 2.0 with PKCE for secure authentication.

Data Encryption

• In transit: All data is encrypted in transit using TLS 1.3.
• At rest: Sensitive data stored in our database (account information, subscription data) is encrypted at rest using AES-256.

API Security

• All API endpoints require authentication (except public marketing pages).
• Request payloads are validated and sanitized on the server side.
• API rate limiting is enforced per-user to prevent abuse.
• CORS is restricted to known Branqo domains only.

Your Code Is Never Stored

Branqo is a local-first application. Your repositories exist only on your machine. When you use AI features, code diffs are processed in real time and are never stored on our servers. Our AI proxy is a stateless pass-through — it forwards your request to the LLM provider, returns the response, and retains nothing. The built-in Secret Scanner ensures that API keys, tokens, and other sensitive patterns are redacted before any code context leaves your machine.

Infrastructure Security

• Our backend services run in isolated containers with minimal attack surface.
• We use automated dependency scanning to identify and patch known vulnerabilities in our supply chain.
• Server access is restricted to authorized personnel using SSH key authentication with multi-factor authentication.
• Application logs are monitored for anomalous activity. Logs never contain user code or sensitive data.

Third-Party Audits & Bug Bounty

We are committed to independent validation of our security practices. Third-party security audits are planned and will be conducted by a reputable security firm. Audit results will be summarized and shared publicly.

Security Contact

For all security-related inquiries, vulnerability reports, or concerns, please contact us at [email protected]. For non-security issues, please use [email protected].