Security

Swarm handles source code and the credentials that reach it, so security is foundational. This page summarizes our practices. Report a vulnerability to security@myrik.in.

Tenant isolation

• All data — runs, settings, credentials, findings — is scoped to an organization. Every API enforces organization-scoped access.
• Members belong to one or more organizations with owner / member roles; a member of one organization cannot read or act on another’s data.

Credentials & data protection

• Connected secrets (Git tokens, model-provider keys, Jira and log-source tokens) are stored encrypted at rest and injected only into the runs that need them.
• Passwords are stored as salted bcrypt hashes, never in clear text.
• All traffic is served over TLS.
• Cloned repositories and worktrees live on ephemeral run compute and are discarded after the run — they are not part of durable storage.

Authentication

• Email/password and Google SSO sign-in.
• Optional TOTP multi-factor authentication per user, with recovery codes.
• Rate-limited sign-in and signup to slow credential-stuffing and abuse.
• Platform-administrator access is gated by an explicit allowlist — never a self-grantable flag.

Infrastructure

• Hosted on AWS (Mumbai, ap-south-1) on managed services with encryption at rest and point-in-time recovery on primary datastores.
• Least-privilege IAM for platform components; per-organization credentials are never shared across tenants.
• Server-side cost caps and per-organization concurrency limits contain runaway or abusive workloads.

Operational safeguards

• A security audit log records sensitive actions (membership changes, credential changes, admin actions).
• Outbound fetches to customer-supplied URLs pass through SSRF protections.
• Agents propose changes as pull requests for human review — Swarm does not merge or deploy on your behalf.

Responsible disclosure

If you believe you’ve found a vulnerability, email security@myrik.in with details and reproduction steps. Please give us reasonable time to remediate before any public disclosure, and avoid accessing or modifying data that isn’t yours while testing.