Tsaro & Responsible Disclosure

Yadda CodePus ke kare lambar ka, takardinka da tawagarka.

Our Tsaro posture

CodePus encrypts bayanan in transit da TLS 1.3 and at rest da AES-256. Tenant bayanan shine isolated per organisation. We follow principle of least privilege domin Duka internal access and rotate signing Maɓalli quarterly.

• TLS 1.3 da HSTS domin every na jamaa endpoint
• At-rest encryption (AES-256) domin Amfani records, secrets and Samfuri traces
• OAuth 2.0 + PKCE + RFC 8628 na'urar-code kwarara ga IDE shiga
• SSO (SAML 2.0 / OIDC) da SCIM 2.0 don tsare-tsaren Kasuwanci
• Per-Buƙata signing of Sabuntawa artefacts (sha256 + https-only)

Biyan Bayanai

We continuously align da industry standards.

• SOC 2 Nau'i II — dubawa in ci gaba
• GDPR & PIPL Ƙarshen bayanai don fitarwa da sharewa da aka fallasa a ƙarƙashin /dashboard/tsaron
• ISO/IEC 27001 sarrafawa da aka tsara, taswirar aikin takaddun shaida da aka buga a ƙasa

Rahoto ɗaya vulnerability

Muna maraba da rahotanni daga masu bincike. Don Allah bi da m bayyana: kada su bayyana batun a fili har sai mun sami wani m lokaci don gyara shi (yawanci kwanaki 90).

• service@codepus.ai
• Hanyar da aka yi amfani da ita don yin amfani da kayan aiki:
• A cikin ikon yin amfani: codepus.ai, *.codepus.ai, IDE binary rarraba da kuma bude-source repository.
• Out of scope: clickjacking on unauthenticated marketing shafi, missing Tsaro headers without proven tasiri, automated scanner Fitarwa.
• Bounties of $100–$10,000 USD sune awarded domin in-scope, reproducible vulnerabilities at discretion of Tsaro Ƙungiya.

Gidan shahararren kyautar kwari

We publish researcher acknowledgements with consent after the issue is resolved. Email service@codepus.ai if you would like to be listed.