Security posture

What PipeWarden actually does with your code, credentials, and findings — and what it doesn't. Updated May 2026.

TL;DR

Free + Pro: your source code never leaves your machine. The CLI runs locally; only finding metadata (severity, category, file/line) is uploaded if you opt in.
Team: same default, plus optional compliance-evidence packs and SSO. Customer-managed keys + self-host on request.
Credentials stored by the binary are encrypted with AES-256-GCM using a per-installation master key. We never see your secrets.
SBOM is published with every release; binaries are cosign-signed. See the releases page.

What we are not (yet)

We are honest about certifications to avoid the dead-deal-after-procurement-googled-us moment.

Standard	Status	Plan
SOC 2 Type I	In progress	Audit kicks off when MRR ≥ $10k (target Q3 2026, via Vanta/Drata)
SOC 2 Type II	Not yet	Year-2 target after Type I clears
ISO 27001	Not yet	Roadmap; revisit at Series A
HIPAA BAA	Self-host only	Self-hosted deploy supports HIPAA workflows; we do not sign BAAs for our hosted SaaS today
GDPR	DPA available	Self-hosted = your DPA boundary. Hosted = standard DPA on request
FedRAMP	Not in plan	Out of scope until clear customer demand

What we collect

Tier	Source code	Findings	Telemetry
Free	Never uploaded	Local SQLite only unless you opt in	Off by default. Set `PIPEWARDEN_TELEMETRY=on` to send anonymous install + scan-count events
Pro	Never uploaded	Synced to your account for trend charts; metadata only (severity, category, file path, line)	Same opt-in as Free
Team	Never uploaded by default; opt-in remote analyzer for Claude-AI tier on critical findings, with per-repo allowlist	Synced to your team account; per-user RBAC	Opt-out; audit log captures all access

Credential vault

PipeWarden stores third-party tokens (GitHub PATs, GitLab tokens, Bitbucket app passwords, etc.) so it can poll your CI/CD systems on your behalf.

Cipher: AES-256-GCM, per-row nonce, per-installation master key derived from PIPEWARDEN_VAULT_KEY.
Storage: SQLite (or Postgres on hosted Team) — never plaintext.
Key rotation: documented in docs/vault-rotation.md. The CLI ships a pipewarden vault rotate command.
No phone home: on Free + Pro the vault decryption happens entirely on your machine.

Supply chain

SBOM: SPDX SBOM published per release via GoReleaser + Syft.
Signing: binaries cosign-signed (keyless / OIDC) — see cosign verify-blob instructions in the release notes.
Provenance: SLSA L3 attestations on the GitHub Actions release workflow.
Dependencies: govulncheck runs on every PR (see .github/workflows/ci.yml); a release is blocked on any unresolved Critical or High in the build chain.

Reporting a vulnerability

Email: security@pipewarden.io
GitHub Security Advisories: new advisory
PGP key: /.well-known/pgp-key.txt
Machine-readable: /.well-known/security.txt

We aim to acknowledge reports within 48 hours and ship a fix within 14 days for High/Critical issues. A bug-bounty program will launch after the first public release.