Security overview
How passo.build keeps your account, your code and your cloud separate from everyone else's, and what always needs a human.
Boundaries
| Boundary | Rule |
|---|---|
| You | Every action is tied to the signed-in person who made the decision. |
| Your organisation | Data for one organisation is never readable or writable by another. Organisation membership is derived from your sign-in on the server, never from anything a client sends. |
| Your project | Tasks, evidence and release records belong to one project. |
| Your repository | passo.build reads the repositories you connected, through your own GitHub connection, and nothing else. |
| Your cloud account | Cloud changes require your explicit confirmation in the console. |
| Secrets | Secrets stay server-side or in a secret store. They are never committed, never shown in evidence, and never sent to a coding agent. |
The security review
Every connected repository is reviewed before it can be released. Findings are tied to the code, and a blocking finding stops the release until it is fixed or explicitly accepted with a recorded reason. Fixes can be handed to your coding agent as tasks. Nobody can promise completely secure. passo.build makes sure the obvious things are handled before anything ships.
What always needs a human
- Releasing to a cloud account.
- Binding or changing a cloud account.
- Changing billing or payment settings.
- Reading or rotating secrets.
- Accepting a blocking security finding.
A coding agent can prepare the work and the evidence. It cannot infer approval from silence.
Evidence and audit
Every decision is recorded with who made it, which project and repository it applies to, when, and what evidence supported it. Sensitive values are redacted before evidence is stored or shown.
Reporting a problem
If you believe you have found a security issue in passo.build itself, email [email protected] before disclosing it anywhere else.