Security

Nothing publishes on its own

• Every draft needs a human approval before it can be published or scheduled.
• An approval is tied to one exact version of a draft. Any edit after approval creates a new version that needs approving again.
• Publishing is idempotent: retries never post the same approved version twice to the same channel.
• Changes that look security-sensitive are never drafted automatically. Only an admin can request content for them, with a reason, and that request is recorded.

Your data stays in your organization

• Every database query is scoped to your organization. Asking for another organization's data returns “not found”.
• Preferences learned from your edits are used only for your organization.
• We don't use your content to train AI models.

Code and content are data, not instructions

• Pull requests, READMEs, issues and web pages are treated as untrusted. Every model call tells the model to ignore instructions found inside them.
• Common secret formats (API keys, tokens, private keys) are redacted before content is sent to a model or stored.
• Model output must match a strict schema before we use it.

Connections

• GitHub connects through a GitHub App, and DevRelay only watches the repositories you select. GitHub webhooks are verified by signature; unsigned or tampered deliveries are rejected.
• X, LinkedIn and Slack connect through their official OAuth flows. You can disconnect any of them in Settings at any time.
• Sign-in and sessions are handled by Clerk; our API verifies every session token.
• The crawler that reads your website only fetches public http(s) addresses, never private, loopback or internal networks.
• Free tools on this site go through a signed, rate-limited gateway, and their inputs are not stored.

Infrastructure

All traffic uses HTTPS. The web app and this site run on Cloudflare, the API on a dedicated server, and the database on Amazon Web Services. See the privacy policy for every provider that processes data for us.

Reporting a vulnerability

If you think you've found a security issue, email support@devrelay.so with the details and steps to reproduce it. Please give us reasonable time to fix it before you share it publicly, and don't access other customers' data or disrupt the service while testing. We'll confirm we've received your report and keep you updated.