SECURITY
Security built around your code.
Sensei is designed for a simple promise: code analysis should be useful without making your source code harder to protect. These controls describe the public posture of the product today.
LAST UPDATED - MAY 29, 2026
TRANSPORT
TLS
Encrypted traffic in production
STORAGE
RLS
User-scoped database access in real mode
TRAINING
No
Customer code is not used to train models
CONTROLS
What protects the product
The controls below cover the public app, authenticated surfaces, mock-mode development, and production provider integrations.
Code privacy by default
Submitted code is scoped to the requesting user or workspace. Sensei does not sell submitted code or use customer code to train foundation models.
Encrypted transport
Production traffic is served over TLS. Sensitive application flows are designed around secure browser sessions and protected API boundaries.
Scoped data access
Application data is isolated through repository boundaries, Supabase Row Level Security in real mode, and file-backed scoping in mock mode.
Key separation
Public browser keys, server-only service keys, and AI provider keys are separated through environment configuration.
Input validation
API routes validate request bodies and query parameters before they reach service or repository code.
Account control
Users can export their data, update settings, and request account deletion from the product settings surface.
DEVELOPMENT
Secure development practices
Security is enforced in the implementation path rather than handled as a separate checklist at the end.
- Validate every public API input before business logic runs.
- Keep authentication and authorization checks at route boundaries.
- Avoid logging submitted source code or provider secrets.
- Maintain separate mock and real provider modes for local development safety.
- Use dependency, type, lint, and build checks before production changes ship.
CUSTOMERS
How to help keep your account secure
ACCOUNTS
Protect credentials
Use strong passwords, avoid shared accounts, and rotate provider keys if exposure is suspected.
SOURCE CODE
Submit only authorized code
Analyze repositories and snippets you own or are explicitly authorized to inspect.
DISCLOSURE
Report issues quickly
Send security findings through the vulnerability disclosure page.