Security
Source Pocket holds keys to your source code and your deploy pipelines. We design for three cases in particular: a lost phone, a malicious repository, and a relay operator who should not be trusted with your data.
Reporting a vulnerability
Email security@sourcepocket.com. Please include the affected component (iOS app, Android app, relay, push gateway, or this website), the version or URL, steps to reproduce, and what an attacker could gain. We will acknowledge your report, keep you updated while we work on it, and credit you when the fix ships if you would like.
We will not take legal action against good-faith research that avoids privacy violations, data destruction, and service disruption, and that gives us reasonable time to fix the problem before you disclose it. Test only against accounts and repositories you own.
Machine-readable contact details are in /.well-known/security.txt.
Draft. This disclosure policy is pending legal review and may change before launch.
Threat model
| Threat | How the app handles it |
|---|---|
| Lost or stolen phone | Credentials live in the Keychain or Keystore. Optional app lock with biometrics. Sign out per account, with guidance for revoking tokens remotely. |
| Tokens with too much access | Each feature lists the minimum token scopes it needs. Accounts can be set to read-only. The app warns when a token has broad scopes. |
| Accidental destructive action | Merge, stop, production triggers, and admin edits ask for confirmation and a biometric check. Notification actions never run a destructive operation directly. |
| Malicious repository content | Markdown is sanitized and never runs scripts. Remote images are blocked by default. Links are checked before opening. |
| Secrets in logs or on screen | Secured variables are masked and never cached. The log viewer can redact patterns on your device. The app switcher snapshot is blurred. |
| A compromised or curious relay | The relay stores metadata only. Private mode encrypts notification content to a key on your device. You can run your own relay. |
| Network attackers | TLS 1.2 or later with certificate validation. Optional certificate pinning for the hosted relay. |
| Supply chain | Pinned dependencies and lockfiles, signed builds, a software bill of materials for each release, and dependency review in CI. |
Where your credentials go
Sign-in uses OAuth with PKCE in the system browser, so the app never sees your provider password. Tokens stay on the device. The relay receives a webhook secret for each repository you enable, not your access token. Where a provider requires admin rights to create a webhook, the app makes that single request from your device.
This website
sourcepocket.com is served over HTTPS only, with HSTS. A content security policy allows scripts, styles, and images from this domain alone and blocks inline scripts. Pages cannot be framed by other sites.