Trust boundary

The security model is visible before the agent starts.

Start with the questions you ask first: what it can access, where code runs, how secrets are handled, when humans merge, what happens on CI failure, and how data is retained.

Review the security model Disclosure policy

Security review starts with exact access, secret handling, egress, merge policy, retention, and disclosure paths.

PermissionsRepo-scoped GitHub access

SecretsBrokered, scoped, leased

EgressPolicy-bound outbound access

MergeHuman review by default

secret.lease() -> no dump into promptegress.policy() -> deny by defaultmerge.policy() -> human required

no training defaultsecurity.txtPGP published

Signed remediation PRboetica/auth-service #42 / hash 91f4e2a0

Single-task sandboxes

Each run receives an isolated hosted sandbox with locked-down outbound access, credential mediation, telemetry, and isolation-assurance evidence.

Secrets mediated

Secrets are not dumped into agent context. Access is brokered, scoped, leased, approved, audited, and redacted from exports.

No-training provider posture

Model routing records provider terms, no-training/no-retention posture, BYOK state, usage, fallback, and eval results for every task.

Trust center

Security review should not require a sales call.

The public trust center names the operating boundary, what access is requested, how secrets are handled, what happens when work fails, and where security reports go.

Access and permissions

Boetica uses scoped repository and connector access to read context, create branches, open PRs, read checks, subscribe to events, and attach evidence. Higher autonomy is an explicit per-repo policy decision.

Scoped repo install
Branch and PR creation
CI and event visibility
No marketing-site access to customer repos

Secrets and runtime boundary

Secrets are mediated instead of copied into agent context. Work runs inside hosted task sandboxes with scoped leases, logged access, and locked-down outbound behavior.

Scoped secret leases
Single-task sandbox
Egress policy
Lease expiry and audit trail

Human review and failure mode

Human review is the default path. If tests, policy, budget, verifier, or CI fail, the workspace shows the failure and next action rather than presenting the PR as ready.

Branch protection respected
Failed checks visible
Rollback note required
Progressive autonomy only by policy

Data handling and disclosure

The trust surface documents retention, subprocessors, provider data terms, tenant export and deletion, disclosure contact, security.txt, PGP, and CSP reporting without claiming certifications that do not exist.

No-training provider posture
Retention and deletion
Subprocessor page
security@boetica.ai and PGP

Disclosure policy security.txt PGP key Retention Subprocessors

Permissions

Boetica asks for the access it needs, not a blank check.

Repository and connector access is scoped, inspected, and recorded. The marketing site remains separate from app credentials, customer repos, and production secrets.

Repo and PR scope
Connector account scope
Protected-secret approval
Marketing-site separation

Merge control

Can it push without review? Not by default.

Human review, branch protection, quality gates, budget caps, and autonomy policy are enforced before higher autonomy is allowed.

Human-in-the-loop default
Branch-protection binding
Autonomy graduation
One-click rollback context

4 files 12 tests 7m 42s CI

@@ apps/web/src/app/api/login/route.ts- await password.verify(body.password)+ await limiter.consume(requestIp)+ await password.verify(body.password)+ await audit.append(evidencePacket)

evidence packetKMS + Sigstore (cosign)

packet hash: 91f4e2a0
prev hash: 5e1c8a44
trust boundary: sandbox attested · egress denied
merge policy: platform-eng / human merge

SOC 2 CC6.6signedNIST AC-6signed

Data handling

Data handling is part of the control plane.

Boetica exposes retention, deletion, tenant export, subprocessors, provider terms, access policy, security disclosure, CSP reporting, and procurement artifacts from the same trust model.

Retention and deletion
Tenant export
Subprocessor list
Responsible disclosure