Security
Report a vulnerability.
Email security@datacartel.io. Please do not open a public issue first. We will acknowledge within three working days and tell you what we intend to do and when.
We do not run a paid bounty. We will credit you in the advisory unless you would rather we did not.
How it is built
Five things that are true about the product.
Sign-in is invite-only, and it does not leak who is a customer
An address without an account gets the same response as one with an account. No email is sent and nothing is written. The endpoint cannot be used to find out who uses the product.
Access is re-read, not snapshotted
Role and scope are re-read from the database on a short cadence rather than frozen into a session at sign-in. Removing someone signs them out. A demotion lands within the cadence, not at their next login.
Cross-tenant isolation is tested, not asserted
Two organisations with identical-looking data, and a test that every query and every action refuses to read or write across the boundary. It runs in CI on every change. It is also the reason the repository is not public yet.
One codebase for cloud and self-hosted
There is no second code path with weaker checks. The isolation suite covers what you run, whichever way you run it, and a fix is a release rather than a port.
Support access is a mechanism, not a promise
Looking at a customer organisation goes through time-boxed, audited impersonation, and the audit trail is visible to that customer. This applies to our own organisation too.
Self-hosted installs
We cannot patch your install. So we tell you.
Fixes ship as tagged releases with a published advisory, and a CVE where one is warranted. Watch releases on the repository if you run it yourself. At launch we support the latest minor version only, which is a smaller promise than most projects make and one we can actually keep.