Read-only, never cloned,
and no token in the database.

A <script> tag in somebody’s README would otherwise execute in our origin, with the reader’s session. Every document is sanitized server-side against an allowlist before it is stored as HTML — not filtered at render time, where one path that forgets is one path that ships an exploit.

The raw markdown stays the source of truth. Rendered HTML is only a cache, keyed by the content's hash and a renderer version, so hardening the renderer invalidates everything at once and nothing has to be migrated.

One API call returns the folder structure plus a content hash for every file. There is no git binary, no working copy and nothing written to disk. Only markdown blobs are fetched, and only from inside the docs root — a source file is a name we may see in a path, never a body we retrieve.

Images inside a private repository are served through an authenticated proxy rather than hotlinked, so they load for the people allowed to see them and for nobody else.

An OAuth session carries the user's GitHub token, so a signed cookie would be a readable one. Cookies are encrypted; passwords are hashed with Argon2 behind a port, never a library whose dependency Python removed.

Revocation is real rather than nominal. Every authenticated request compares an epoch on the account row, which is the honest price of withdrawing a credential that carries its own validity — a decrypted cookie is not an authenticated one. Signing out every device is one action, and disconnecting GitHub invalidates the sessions that carried its token rather than leaving them working until they expire.

There is a session list: a coarse platform label and an address truncated to a /24. No city, no country, and no guess about whether a sign-in was unusual — those need a geolocation database or a model of usual, and inventing either is how a device list starts reporting incidents that never happened.

Joining an organization hands out no documents. A member reads a project through a team grant or a direct one; somebody in no team with no grant reads nothing at all. There is no visibility setting that quietly confers access to everybody.

Access resolves server-side, in the one query every reader route already flows through. A repository you have lost access to answers 404 — identically to one that never existed, so the response cannot be used to learn what exists.

No role comparison happens in TypeScript. Even the per-row 'may this person be removed' answers the Members screen renders are computed on the server, so no copy of the hierarchy reaches the client to drift.

A self-managed GitLab host is a URL a customer types and the server then fetches, which is an SSRF primitive. The checks are pure predicates: https only, every resolved address checked against private, loopback, link-local and reserved ranges, and redirects refused outright rather than followed and re-checked.

Webhook order is fixed and never rearranged: raw body, then the signature compared in constant time, then parse. Reading a payload before verifying it is parsing something a stranger sent.

The client address is configuration rather than a header. At the default, forwarded headers are ignored entirely; where proxies are counted, the address is taken from the end a caller cannot extend by prepending.

A key can carry a minimum review state, and documents below it answer 404 on every door — the reader routes included, because a floor that stops at one surface is a floor with a second front door. It lives on the credential rather than in a tool argument: a filter the agent passes is a filter the agent can be prompted out of passing.

No tool on that surface mutates a repository document, closes a reviewer's note, deletes an artifact, or asks a model a free-text question. Those are absences rather than settings — there is no flag an administrator can grant, which is the point.

This is the one outbound path carrying customer content, and the switch is off by default — defaulting it on would have started every existing organization sending documents to a third party because a deploy happened. Turning it on is written to the audit log.

An empty document makes no call at all: prompting a model not to invent is a request, whereas not calling it is a guarantee. A provider named without its key refuses rather than returning placeholder text, because a fabricated summary stored against real content is served as real until that content changes.

Never after the commit, never best-effort, never from a background job. If the change rolls back the record goes with it, and if the record cannot be written the change does not land. The actor's name and the subject's label are copied onto the row, because a deleted team still has to read as the team it was.

The trail is filterable and exportable, and kept for the window your plan sets. Nothing can delete a single row from it — a caller able to remove one row is a caller able to remove the interesting one.