Kodmos
Get started

Trust

Security

Last updated

What Kodmos can do in your GitHub organization, what it stores, who it relies on, and how to tell us about a vulnerability.

In short

  • An owner of your organization installs the GitHub App and chooses which repositories it may see.
  • No source code and no GitHub tokens are stored. Your organization’s data is encrypted at rest and backed up daily.
  • Workflows Kodmos starts still follow GitHub’s environment protection rules, such as required reviewers.
  • Found a vulnerability? Write to [email protected]; we answer within two working days.

A summary to help you read it. The full text below is what applies.

01What the GitHub App may do

Kodmos is a GitHub App. An owner of your organization installs it and chooses which repositories it may see; it asks for these permissions, and only uses them as described:

ActionsRepository, read and writeList workflows; start, cancel and follow their runs; read the log of a failed job.
ChecksRepository, read-onlyShow whether CI passed on the branch someone answered with.
Commit statusesRepository, read-onlyShow whether CI passed, for CI systems that report commit statuses.
ContentsRepository, read and writeRead branches, commits and workflow files, and compare commits for release notes. The only thing Kodmos writes is its own release tags (kodmos/<event>/<deploy>), which pin the commit an event locked; it never pushes commits or changes files.
MetadataRepository, read-onlyRequired by GitHub for every app.
Pull requestsRepository, read and writeList the pull requests in a release, and, for organizations that turn it on, keep one comment on each saying when it deploys.
MembersOrganization, read-onlyCheck who is in the organization (only they can be invited or ask for access) and keep that list current.
Email addressesAccount, read-onlyEach person's primary verified address at sign-in, so emails reach them.

Workflows Kodmos starts run as the app (<app>[bot]), so GitHub’s environment protection rules, such as required reviewers, still apply. Signing in uses a short-lived GitHub token that Kodmos does not keep.

02What is stored, and how

  • Your organization’s flows, events, teams, runs, deployment history and audit log, in a Postgres database, encrypted at rest by the host and backed up daily.
  • No source code: only names, workflow files (for their inputs) and commit metadata.
  • No GitHub tokens: installation tokens are fetched when needed and live in memory for at most an hour.
  • Invitation links and confirmation links are stored only as hashes and work once.

Access is checked on the server for every request, by organization and role (member, DevOps, owner). Everything travels over HTTPS; sessions are signed, HTTP-only cookies, and pages send a strict Content-Security-Policy. Sign-in, invitation links and access requests are rate-limited.

03Services Kodmos relies on

AnthropicOnly for organizations that turn on summaries of failed deployments. The last lines of a failed step’s log are sent to Claude, which writes a short summary of the cause; nothing else is sent.
GitHub (Microsoft)Signing in, and the GitHub App that reads workflows and starts runs in your organization.
RailwayHosting the Kodmos server and its Postgres database.
ResendSending emails.
SentryError reports, so problems get fixed. They carry the organization, the page or task that failed and technical details, not the content of your repositories.
StripePayments, invoices and sales tax for paid plans. It gets the billing contact, address and tax ID you give it, and your card; Kodmos never sees or stores card numbers.

04Reporting a vulnerability

Write to [email protected] with what you found and how to reproduce it. We answer within two working days, keep you informed while we fix it, and credit you if you wish. Please give us reasonable time to fix it before telling others, and do not access data that is not yours while testing. Our security.txt is at /.well-known/security.txt.

Found a vulnerability?

Write to [email protected], or read our security.txt.

Write to us