Security and data

This page answers what a security review asks about hushrun's hosted service: what it keeps, where, how it's protected, and who else sees it. The privacy policy is the binding text, and this page follows it.

What leaves your machine

hushrun hashes your files on your machine. Your source code doesn't leave it. The one file it sends whole is hushrun.yaml, which hushrun plan uploads for promotion.

Each result holds:

• the check's name, and whether it passed, failed or skipped, with the exit code;
• the command, argument by argument, and the directory it ran in;
• the scope and the digest of its files, the commit, and the repository's name;
• the CI job and its system, such as unit@linux/amd64, and a link to the CI run;
• when it started, how long it ran, and the hushrun version;
• the system it ran on, such as linux/amd64, and, for a check with a counts_from rule, the tool versions it measured;
• the paths and digests of files outside the repository that its scope declares, and for a skip, the time it saved;
• the HUSHRUN_INVOKED_BY label, if you set one.

The server adds who recorded it, a member's email, an agent's name, or the repository and branch or environment CI ran for, and the machine that signed it.

When you sign in on a machine, hushrun also sends its host name and the public half of its key.

A result holds no output, no logs and no source. The command goes as written, so keep secrets out of its arguments. hushrun doesn't send your environment variables. Where results go shows a whole result.

The CLI has no telemetry. At a terminal, it asks GitHub about once a day whether a newer release is out; HUSHRUN_NO_UPDATE_CHECK turns that off. Results kept on your machine, or on a server you run, send nothing to hushrun.

Where it's kept

• The service and its database run on Google Cloud, in the United States, in the us-central1 region. The database is PostgreSQL, on Cloud SQL.
• Server logs are kept for 30 days.
• Database backups are kept for up to 14 days, so what's deleted can stay in a backup until then.

There's no choice of region.

How long it's kept

• Results and the audit log are kept while the organization exists, and events until an admin deletes them. Each plan names the history it includes, but today the hosted service deletes no history on its own.
• Old promotion events can be deleted by an admin with hushrun repository gc. The transparency log keeps a record that each one existed, and who deleted it.
• To delete your account or your organization, write to [email protected] from your account's email address. Deleting an organization deletes its results and audit log. There's no button for it in the dashboard.

How it's protected

• In transit: the API and the dashboard are served over HTTPS, and the database takes only encrypted connections.
• At rest: Google Cloud's default encryption. There are no customer-managed keys.
• Secrets: sessions and tokens are kept only as SHA-256 hashes, never the token itself. For machines and agent tokens, the server keeps only the public half of each key; the private half stays with you, on the machine or in the agent's HUSHRUN_AGENT string.
• Signed results: a result from a person or an agent must carry a signature from a registered machine's key, ECDSA P-256 or Ed25519, or the server refuses it. A result from GitHub Actions comes with the job's ID token, which the server checks against GitHub's published keys. See Who can record a pass.
• Limits: the server caps how many results a credential records a minute (Other limits).

Who can see what

• Members see their organization's results and dashboard. Admins and owners change its settings, members and tokens (Roles).
• An agent token made for one repository reads that repository's results only.
• The audit log lists every admin action, with who did it, for admins and owners. It has no export.
• hushrun's staff can see an organization's plan, usage, members and repositories in an internal admin app, to run the service and answer support. Viewing there isn't in your organization's audit log; a change staff make, such as to your plan, is.

Sign-in and credentials

• People sign in with GitHub. hushrun asks GitHub for the profile and email addresses (read:user and user:email), uses GitHub's token once, and doesn't keep it. Two-factor authentication is your GitHub account's: hushrun doesn't add its own.
• A dashboard session lasts 30 days.
• A machine's sign-in doesn't expire. A machine unused for 90 days is revoked; signing in on it again brings it back. An admin can revoke one at any time (Machines).
• An agent token lasts 30 days unless you set --expires, and 365 days at most (Agent tokens).
• Removing a member stops what their machines sign from then on. What they recorded before stays.

Who else processes data

The privacy policy's Who else sees it is the full list.

What hushrun doesn't offer yet

• A SOC 2 or ISO 27001 report.
• Single sign-on (SAML) or SCIM.
• An uptime commitment, a service level agreement or a status page. When the service can't be reached, your checks still run (When hushrun runs anyway).
• A choice of region.
• An audit log export, or deletion from the dashboard.

If your review needs one of these, or a questionnaire answered, write to [email protected]. To keep results off hushrun's service altogether, run your own server.

Report a vulnerability

Write to [email protected], with what you found and how to reproduce it. hushrun replies within 3 business days.

Next

• Privacy policy: what hushrun collects, and your rights.
• Who can record a pass: what a signature proves.
• Where results go: your machine, hushrun's service, or your own server.