Security and trust: Nihub

Identity

OIDC with PKCE

Sign-in runs through the identity gateway. Sessions are opaque and rotate, and the return path is restricted to approved routes inside the application.

Tenancy

Forced row-level security

PostgreSQL enforces the tenant boundary. Hostile cross-tenant reads and writes are part of the integration suite, not an assumption.

Authorization

Deny by default

Role, relationship and resource-scoped checks refuse by default, and the service that owns a resource is the one that resolves it.

Commands

Proof before effect

Consequential writes require same-origin CSRF proof, a strong If-Match precondition, and an idempotency key.

Step-up

Assurance where it counts

Tenant security, domain and machine-identity changes require a fresh step-up. An expired step-up is refused rather than stretched.

Evidence

Append-only audit

Actor, target, result, correlation and relevant before and after fields, with sensitive values redacted and retention controlled.

01 · Isolation

The tenant boundary is not application logic.

Isolation that lives only in query builders fails the first time somebody writes a query by hand. Nihub puts it under the application.

At the edge

Untrusted headers are overwritten. The gateway sets the tenant context itself and authenticates to internal services with a service credential.
Tenancy comes from the session. Not from a URL segment, not from a browser field, and never from a request header a caller controls.

At the storage layer

Row-level security is forced. A missing filter in application code does not become a cross-tenant read.
It fails closed. Fail-closed row-level security and hostile cross-tenant access are exercised in the isolated integration suite.

02 · Intelligence

What Nihub refuses to do with your data.

Governed sprint intelligence is the part of the product most likely to worry a security reviewer, so it is the part with the hardest constraints.

The constraints

Disabled by default. The feature ships off. Enabling it is a decision somebody has to make and own.
No external provider. There is no external intelligence provider and no outbound data path in this release.
Deterministic. Recommendations are derived, bounded, and linked to the evidence they were derived from.

The boundary

Distinct-human approval. The proposer cannot approve. A stale recommendation is denied rather than applied to a plan that has moved.
Reversible application. An applied recommendation can be reversed, and the receipt survives the reversal.
Isolated roles. The executor and retention roles are separated from each other and from the application role.

03 · Release integrity

A build that cannot prove itself does not ship.

Supply-chain controls are part of the product, because a governed application delivered through an ungoverned pipeline is not governed.

Packaging and promotion

Digest-pinned deployment. Staging and production Compose reference digests, not moving tags.
Exact Git archive packaging. Multi-platform images are built from the exact archive of one commit.
Scan before promotion. The image audit fails on known critical or high vulnerabilities.
Signature and attestation. Promotion requires Cosign verification and a fresh pipeline-bound runtime attestation for every live service image.

Operating it

Progressive rollout and rollback. Services move in cohorts, with preflight tooling in front of them.
Backup and isolated restore. Restore runs into an isolated project rather than over the live volume.
Migration replay and restart durability. Proved against a real PostgreSQL in the integration suite, not asserted.

04 · Targets, not claims

Where the line is.

These are stated requirements the product is built against. They are not certifications, and this page will not present them as achieved results.

Control targets

OWASP ASVS Level 2 is the control target.
Encryption in transit and at rest, least privilege, secret rotation, signed events and rate limiting.
WCAG 2.2 AA is the accessibility target for supported workflows.

Not claimed

No third-party audit report, certification or availability record is published here, because none has been produced. If you need one for a procurement decision, treat it as outstanding.

Get in

Open it, or read how it refuses.

Nihub is built to be audited before it is admired. Start with the workspace or start with the boundary. Both doors are on this page.

Built to be audited.