Security model

• Keys: random, shown once, stored as SHA-256 hashes, scoped and environment-bound, revocable immediately.
• Isolation: dashboard reads go through Postgres row-level security; API writes are scoped to the key's workspace.
• Policies fail closed: no policy or no matching rule means denied.
• Outbound requests (tools, webhooks) are HTTPS-only to public addresses, signed with HMAC-SHA256, never follow redirects, and time out.
• Secrets for signing are encrypted at rest (AES-256-GCM).
• Every decision, approval, result and request is recorded with its request id.

NoteGasket has not completed a third-party audit or certification. Read the full security page for what isn't built yet.