Security

Last updated 16 September 2026.

This page explains how Truestate keeps a team's board private, in everyday words. It summarizes the security model the product is built to; the full model is in the product documentation and available on request.

Who can see a board

  • Only people listed as members of a repository can see its board. Membership is a list in your own repository, kept by your team.
  • Sign in is by a link sent to your email. Your identity on the board is that email, matched against the member list, and never a display name that someone could change.
  • Anyone who is not a member sees a page that does not exist, not a locked door. The board's existence is not confirmed to outsiders.

How your repository is read

  • Through a GitHub App your organization installs once, with only the permissions the board needs: reading and writing the tracker files and the note screenshots, and reading and writing issues.
  • The App's private key never leaves our servers and is never in the browser. Short lived tokens are minted for each request.
  • We cache what we read for up to an hour and clear the cache whenever you make a change, so what you see is current.

How changes are made

  • Every action you take on the board is checked in the same order, every time: that the request came from the board itself and not another website, that you are signed in and a member, that the request is well formed, and that you have not exceeded a sensible rate. Only then does it touch your repository.
  • The board changes only the issues it created. It never edits your code.
  • Every change lands as a commit or an issue comment in your repository, so git history and GitHub are the audit trail, and we keep an audit log of board actions as a second record.

Questions you type

  • A question typed on the board is answered by an agent that reads your repository with read only tools. It cannot write files, push, or change anything except adding one label and posting its answer.
  • The text of a question is treated as untrusted. The agent is told to answer it, never to follow instructions inside it, and to say so if it was asked to do something it should not.

Hours and privacy

  • Hours come from a clock the engineer controls and can stop. Every figure has timestamps behind it. A correction is signed with who made it and when.
  • A team can turn hours off entirely with one setting; the data is still recorded so the setting can be turned on later without loss.

Production

  • Nothing your scheduled nightly close does can deploy code. Production ships only through a deliberate step after your tests pass.

Reporting a problem

If you find a security issue, email security@truestate.space. We read every report and reply within two business days.