Security Policy
How we secure credentials, manage API tokens, and handle vulnerabilities responsibly.
1. Security Overview
OSSIntel is engineered to audit codebase quality and metrics securely. We prioritize data integrity and minimal exposure. Since we only request read-only access to metadata, we never write code or modify repository settings.
2. GitHub App Authentication
Our platform interacts with GitHub using a GitHub App. App communication is authenticated using a Private Key (PEM format) issued by GitHub.
This private key is securely stored inside server environment variables (never committed to version control) and is decrypted in memory only to sign JSON Web Tokens (JWTs) when requesting installation access.
3. Least-Privilege Permissions
We follow the principle of least privilege. We only ask for the permissions absolutely necessary to run our metrics:
- Metadata (Read-only): Required to fetch repository info, stars, and basic package data.
- Pull Requests (Read-only): Required to analyze code review cycles and contributor velocity.
For more details, see our dedicated GitHub Permissions page.
4. Installation Tokens
OSSIntel generates temporary installation access tokens on-demand.
Token Lifecycle
These tokens are valid for a maximum of 1 hour, are stored only in volatile memory caches during active requests, and are never saved to a database. They expire automatically and are rotated securely without human intervention.
5. HTTPS / SSL Standards
We enforce HTTPS for all connections to the OSSIntel platform. All data transferred between your browser, our servers, and third-party APIs (GitHub, npm, Stack Overflow) is encrypted in transit using Transport Layer Security (TLS 1.3 or TLS 1.2).
6. Responsible Disclosure
We welcome vulnerability reports from researchers and security engineers. If you find a security bug in OSSIntel:
- Do not publicly disclose the issue before giving us a reasonable time to patch it.
- Do not exploit the vulnerability to view private data or disrupt service availability.
- Provide clear, reproducible steps so we can confirm and address the issue quickly.
7. Contact Security
Please report security vulnerabilities or concerns directly to our security team at:
security@ossintel.org
We will acknowledge receipt of your report within 24 hours and keep you updated as we work to investigate and resolve the issue.