Security & Vulnerability Disclosure

Wharby is built to protect the confidentiality, integrity, and availability of your source code and code review workflows.

1. Security Commitment

• Workspace Isolation: Each customer workspace operates in an isolated environment with dedicated access controls and storage boundaries.
• Encryption: All web, API, and Git traffic is encrypted in transit using HTTPS/TLS or SSH. Customer data and credentials are encrypted at rest.
• Least-Privilege Access: Operational access to production systems is restricted to authorized personnel following strict least-privilege principles.

2. Identity & Access Control

• Delegated Authentication: Wharby delegates user authentication to trusted identity providers (Google and GitHub) using industry-standard OAuth 2.0 flows.
• Zero-Trust Workspace Authorization: Every workspace enforces explicit administrator-configured Access Grants. Removing a grant or revoking organization/team membership immediately terminates active workspace access.

3. Responsible Vulnerability Disclosure

If you believe you have discovered a security vulnerability in Wharby, please report it to us privately so we can investigate and remediate the issue promptly:

• Security Contact: wharby-support@googlegroups.com

Please include a clear description of the issue, steps to reproduce, and any relevant URLs or request identifiers. We ask that you give us a reasonable opportunity to resolve the issue before any public disclosure.