Security
If you've found a security problem in Northwick, email security@northwickcode.com. A person reads every message.
Reporting a vulnerability
Please include:
- What you found and where.
- Steps to reproduce it.
- What someone could do with it.
We'll reply within three working days, keep you updated while we fix it, and credit you when it's fixed if you'd like to be credited. Please give us a reasonable amount of time to fix the problem before you publish anything about it.
This policy is also published at /.well-known/security.txt.
Scope
In scope:
- northwickcode.com
- The Northwick apps for GitHub and GitLab
- Task sandboxes, including getting out of one, reaching another customer's data from one, or reaching our infrastructure from one
Out of scope:
- Automated scanner output without a working problem behind it
- Missing headers or settings with no way to exploit them
- Social engineering or phishing of anyone at Northwick
- Denial of service and volume testing
Safe harbour
If you act in good faith, stay in scope, don't access or keep anyone else's data beyond what you need to show the problem, and give us time to fix it, we won't take legal action against you or ask anyone else to.
Bug bounty
We're pre-launch and don't have a paid bounty programme yet. We'll say so here when that changes.
How we handle your code
- Each task runs in a new container, which is deleted when the task ends. We don't keep a copy of your repository afterwards.
- The Northwick app asks only for the repository permissions it needs: read code, push to branches it creates, open pull requests, and comment on issues.
- The access token for each task is issued when the task starts and expires when it ends.
- Northwick only pushes to branches that start with its branch prefix. It never pushes to your default branch and never merges.
- Sandboxes don't get your CI secrets or environment variables.
- Data is encrypted in transit and at rest.
- We don't use your code to train models, and the model providers we use don't either. See Privacy.