Security at
CodeAgento
We take security seriously. Here's how we protect your code, data, and privacy.
Security by Design
Three foundational principles that guide every architectural decision.
Server-Side Only
Database logic never runs in the browser
Privacy First
Your code stays yours. AI is opt-in
Defense in Depth
Multiple layers of access control
How We Protect You
A comprehensive look at every layer of our security architecture.
Authentication & Access Control
- Session-based authentication with httpOnly cookies, no tokens in localStorage
- All database operations run server-side via Next.js server actions
- Role-based access control: Developer, Team Lead, Admin
- Per-object ACLs ensure users can only access their own data
- Session tokens are never exposed to client-side JavaScript
Data Protection
- All data stored in MongoDB with access controls and authentication
- Passwords hashed with bcrypt (never stored in plaintext)
- Environment variables stored securely, never committed to source control
- Database connections use authenticated credentials
- File uploads scoped to authenticated users with ACL enforcement
Network Security
- HTTPS enforced on all connections
- CORS configured to allow only trusted origins
- Rate limiting on API endpoints to prevent abuse
- Webhook signature verification for Stripe and external services
- No sensitive data in URLs or query parameters
AI & Code Privacy
- Code is only sent to AI models when you explicitly use AI features
- No automatic telemetry or code analysis without consent
- AI generation requests are not used to train models
- Prompt history is stored per-user with ACL protection
- You can delete your AI history at any time
Infrastructure
- Node.js backend with security best practices
- MongoDB 7 with authentication and access controls
- Redis 7 for session caching with password protection
- Docker containers run with minimal privileges
- Multi-stage Docker builds exclude development dependencies
Team & Admin Security
- Team leads can only manage projects they own
- Admin actions are logged in the audit trail
- Member invitations require email verification
- Role changes require admin privileges
- Project deletion is restricted to owners
Security Architecture
How data flows through our secure, server-side infrastructure.
Security Practices & Compliance
Industry-standard practices we follow to keep your data safe.
What Security-Conscious Teams Say
From CISOs to freelancers, hear why they trust CodeAgento.
“We evaluated CodeAgento's security architecture before rolling it out to our 200-person engineering team. The server-side-only approach and per-object ACLs gave us the confidence we needed.”
James Park
CISO, Finova Labs
“As a solo developer, knowing my code never touches AI models unless I explicitly ask is a huge relief. CodeAgento's privacy-first approach is refreshing.”
Elena Vasquez
Freelance Developer
“The responsible disclosure process was smooth and professional. The team patched and credited us within 48 hours. That's how it should be done.”
Kai Nakamura
Security Researcher
Security Questions
Common questions about how we protect your code and data.
Is my code sent to AI models automatically?+
Where is my data stored?+
Does CodeAgento use my code to train AI models?+
How do you handle authentication?+
How can I report a security vulnerability?+
Do you support SSO for enterprise teams?+
Found a Vulnerability?
We appreciate responsible disclosure. Please report security issues to our team. We aim to patch within 48 hours.
Report a Security Issue