How we protect your code
We ask customers to trust us with source code and live systems. Here is what that trust rests on.
What is actually in place
Atlas parses repositories to an AST. It does not install dependencies, run build scripts, or evaluate configuration. A hostile repository cannot execute code on our infrastructure.
Repositories are cloned into an isolated, run-to-completion task and the workspace is discarded when it ends. Code is never written to long-term storage.
Ares requires both an approved source repository and DNS-verified host before testing starts. Scope and address checks block private, loopback, link-local, and cloud-metadata ranges. Because testing is intentionally aggressive, the product directs customers to disposable staging environments, never production.
Every organisation-owned table has row-level security, so a query can only ever return rows for organisations the caller belongs to. This is enforced by Postgres, not application code.
Each service holds only the secrets it needs, stored in AWS Secrets Manager and injected at task start. Engine tasks hold no AWS permissions at all.
Evidence captured with a finding passes through redaction before storage, so tokens and credentials observed during a scan are not persisted verbatim.
Reporting a vulnerability
If you believe you have found a security issue in Sentesting, email security@sentesting.space. Include enough detail to reproduce it.
- • We acknowledge reports within 3 working days.
- • We will tell you our assessment and expected timeline within 10 working days.
- • We will not pursue legal action against good-faith research that follows this policy.
- • Please do not access other customers’ data, degrade the service, or run automated scans against our production systems while testing.
- • We will credit you when the issue is resolved, unless you prefer otherwise.
We do not currently run a paid bug bounty.
What we have not done yet
We would rather be accurate than impressive. Sentesting is a young product and the following are not yet true:
- • We do not hold SOC 2, ISO 27001, or any third-party security certification.
- • We have not had an independent penetration test of the platform.
- • We do not offer a contractual uptime SLA on self-serve plans.
Our reports are built to support your SOC 2 or ISO evidence gathering. That is different from us being certified, and we will not imply otherwise.