Security

deplo.ai's security model starts from an architectural decision: we hold credentials, never infrastructure. Your applications run in your own Vercel and Render accounts, so the blast radius of anything happening to deplo.ai is limited by design — and everything we do hold is revocable by you in one click.

Credential handling

• Encrypted at rest. GitHub access tokens, Vercel OAuth tokens, and Render API keys are encrypted with AES-256-GCM before touching the database. They are never logged and never returned by any API after initial entry.
• Validated before stored. A Render key is checked live against the Render API before we keep it — invalid credentials are never persisted.
• CLI tokens are hashed. Only a SHA-256 hash is stored; the raw dpl_ token is shown exactly once. Each token is named, tracks last use, and is individually revocable in Settings.
• Per-user isolation. There are no global deploy credentials. Every deployment runs with the credentials of the account that owns it, nothing more.

Transport and application security

• All traffic is TLS. The browser only ever talks to the deplo.in origin; the backend origin is never exposed to it.
• API authentication uses short-lived signed JWTs (7-day expiry) or hashed CLI tokens.
• Rate limiting (200 requests / 15 minutes / IP), Helmet security headers, and strict CORS allowlisting on the API.
• GitHub webhooks are verified with HMAC-SHA256 signatures before any action is taken.
• The CLI's browser sign-in only ever delivers tokens to a loopback address (127.0.0.1) with a single-use nonce.
• SQL access goes exclusively through parameterized queries via Prisma.

What AI can and cannot see

AI analysis (Groq) receives bounded repository excerpts — file trees, small config files, dependency lists — and failure logs. It never receives environment variable values, provider credentials, or tokens. AI output can suggest, but deterministic checks decide.

Infrastructure

The platform runs on managed, SOC 2-audited infrastructure: Vercel (frontend), Render (API, workers, Redis), and Neon (PostgreSQL). We deliberately operate no servers of our own.

Your kill switches

Everything deplo.ai can do, you can revoke unilaterally:

• Uninstall the GitHub App / revoke OAuth — GitHub settings → Applications.
• Remove the Vercel integration — your Vercel dashboard, or Dashboard → Integrations here.
• Delete or rotate the Render API key — Render dashboard; the stored copy becomes useless instantly.
• Revoke CLI tokens — Settings → CLI tokens.
• Delete your account — Settings → Danger Zone; your deployed apps keep running.

Reporting a vulnerability

Found something? Email deploai201@gmail.com with “SECURITY” in the subject. Please include steps to reproduce and don't access other users' data while testing. We'll acknowledge quickly, keep you informed, and credit you if you'd like once it's fixed. Good-faith research conducted under these rules will never result in legal action from us.