Security. How Reqursor handles your code.
On the hosted version and on Linux, every ticket runs in a sandbox. The rules it keeps are written in code, and by default nothing is merged or released until a person says yes. Here is what it can touch, where your data goes and what it refuses.
On a ticket
Each ticket runs in a sandbox.
The agent sees one copy of your code and nothing else. Ticket text is treated as untrusted.
- Every stage starts clean, and a fresh reviewer checks the work
- If the sandbox can't run, the worker won't start without it
The sandbox runs on the hosted version and on Linux. On Windows the agent runs without it, so use a machine you dedicate to it.
Agent isolation in the docsDuring a ticket the agent can reach
- This ticket's own copy of your code
- Hosts on your allowlist, such as package registries
- The AI model, with a short-lived token
Out of its reach
- Your database and saved secrets
- Your other projects
- Your git host
- Your model provider key
Where your data goes
Where your code goes.
On a ticket, Reqursor sends your code and ticket text only to the places on the right. Hosted or self-hosted changes one thing: the route to the AI model.
Hosted or self-hosted?For a security review: the sub-processors and the data processing agreement.
Your code and ticket text
- The AI modelHosted
Through Reqursor's relay, which keeps no prompts or answers
Self-hostedStraight to your own provider, never through Reqursor
- Your git remote
The change, once you turn pushing on
- The tools you connect
Email, Slack, a webhook, GitHub, GitLab, Jira or Linear
- Reqursor's license server Never your code
A daily license check. Hosted, also a usage record for each AI request
Stored on the servers Reqursor runs for you, or on your own server. Apart from the license server, nothing is reported back.
The license check
Eight fields a day, and nothing else.
Once a day, at a random time, the install checks its license with license.reqursor.com. The check is the same hosted or self-hosted, and it is the only regular telemetry.
- No code, ticket text, repository names or branch names
- No user names, email addresses, prompts or model output
- Nothing about which model provider you use, and nothing of its key
- If a check fails, the install tries again within the hour and keeps working while its license is valid
The license server can't read your data or switch your install off. Without a valid license no new work starts, and nothing is deleted. On Enterprise, an offline license file can replace the daily check.
What the license check sendsRules in code
Rules it can't be talked out of.
A model can be talked out of an instruction. It can't be talked out of code that refuses the command, so these hold whatever a ticket says.
- Force-pushes, history rewrites, skipped hooks and pushes to protected branches are refused
- By default, CI workflows, git hooks, env files, secrets folders and reqursor.yaml can't be changed
- A secret scan checks every changed file and every commit the agent made, before the change can ship
- A new package outside your allowlist blocks the change
- Reqursor makes every commit itself and never merges. Fast mode reaches your main branch only after a person types its name
Secrets
Keys go in. They never come back out.
Every key and token you store is write only. You can replace it or remove it, but nobody can read it back, the Owner included.
- Encrypted at rest with AES-GCM, under a master key kept outside the database
- Masked in logs, the live run view, the audit log, notifications, pull requests, commit messages and diagnostics
- Point a credential at a new address, and it is removed, so it can't be sent to a server that would read it
- Every use is in the audit log by name and purpose, never the value, and entries can't be edited in the dashboard
The masking knows every stored secret and the usual token shapes. It can't know a password someone types into a ticket, so keep passwords out of tickets.
Roles and the audit logAI chat
The chat can only propose.
It acts with the rights of the person asking, never more. A change it proposes is a card built from checked values, and nothing happens until that person presses Confirm.
- It has no tool at all for users, API tokens, secrets, the license, billing, updates, check commands or pushing
- It never writes a link itself, so an answer can't send you somewhere else
- Conversations are kept per person for 30 days by default, and nobody else can read them in the dashboard
Online stores Early access
Each store kept apart.
In early access, the AI chat can change how an online store looks. What a request to the AI may hold is limited before it is sent.
- Each store runs in its own environment, with its own network and storage
- A request to the AI holds one organization's data, never another's
- By invitation: today we show it to you in person
Limits
What it does not protect against.
No software defends against everything. These are the limits our own security model names, so you can plan around them.
- A compromised model providerIf the provider is malicious or taken over, our defenses sit after it, not before.
- A compromised hostIf the machine that runs Reqursor is taken over, Reqursor is too.
- Running without isolationOn Windows, the agent can read what its own account can read.
- Your own administratorsOwners and Admins set the checks, the git remote and who has access. They still can't read a secret back.
- Data sent where it is allowedWhat the agent read can travel to your model provider or a host on the allowlist. Keep that list to what your builds need.
- Bugs your checks missThe checks catch what they test for. That is why, by default, nothing is merged or released until a person says yes.
Found a vulnerability? Tell us privately.
Email [email protected] with what is affected, the steps to reproduce it and the impact you expect. Please keep the details private while we fix it, never put live passwords or keys in a report, and ask us first if you want to test our systems.