How access, credentials and stored code work on Upstream, and how to report a vulnerability.

Report a vulnerabilityPrivacy and DPA

A push is refused unless the credential is valid, your role allows the write and the branch rules agree. Then Upstream stores it before Git reports success.

A push passes four checks before Git reports success: the credential, write access to the repository, the branch rules, and a durable write to storage.

  • Four roles

    Read, write, maintain and admin, given to a person or a team. The server checks the action being asked for against the role. It never trusts a role sent by the browser.

  • Hidden stays hidden

    A private repository, Change Request or Issue answers "not found" to anyone who can't see it, so nobody learns that it exists.

  • Contributors without access

    Anyone can fork a public repository and send a Change Request. Contributing gives them nothing else in your organization.

  • Share links that expire

    An admin can share a private repository by link for 7, 30 or 90 days. People with the link can read code and commits. They can't clone, push or see Issues.

Shown once, stored hashed
Git credentials, personal access tokens and workspace keys are shown when you create them and stored only as a hash after that.
As narrow as the job
Git credentials belong to one repository and can be read-only. Tokens carry scopes, an optional list of repositories and an expiry date.
Short-lived for the CLI
The Upstream CLI keeps its session in your system's credential store and asks for short-lived Git credentials capped at your real role.
Revoke one, keep the rest
Every credential can be revoked on its own from settings. Read-only automation credentials name the service they belong to.

Review rules apply to the exact code being merged, and they're on every plan.

  • Approvals that expire

    An approval counts only for the version of the Change Request it was given. Pushing new code marks older approvals out of date.

  • Branch protection and CODEOWNERS

    Require approvals from the owners of the files a change touches, and make the default branch accept changes only through Change Requests. Both are on the Free plan.

  • Required checks

    Block merges until CI and other checks pass on the exact version being merged. Kairo Review can be one of them.

  • Merge queues

    Queued Change Requests merge one at a time, in order, and each one is checked again right before it merges.

Encrypted in transit and at rest
Traffic to Upstream uses TLS. Our storage providers encrypt data at rest.
Durable before done
Upstream writes a push to durable storage before Git reports success. A push that says it landed has landed.
Backups
The database and repository storage are backed up.
No training on your code
Your code is never used to train models. Kairo reads only what a review or answer needs, and only from repositories the person asking can read.

Enterprise connects Upstream to your company's identity provider and audit tools.

  • Required single sign-on

    Enterprise organizations can make every member sign in through their identity provider. SSO sessions last 12 hours.

  • Authorized credentials

    After SSO, members authorize their Git credentials for the organization before those credentials reach its repositories.

  • Directory sync

    Add and remove members, and keep groups in step, from your connected directory.

  • Audit log

    Membership, team and access changes are recorded for administrators. Enterprise can export the log and stream it to your own destination.
Upstream for Enterprise

Email security@coline.app with what you found, how to reproduce it and what it affects. We'll confirm we got it, keep you posted while we fix it, and credit you if you'd like.

Don't post vulnerability details in public Issues or Discussions. If you found an exposed secret in someone's repository, email us without including the secret.

Rules for research

  • Test only against your own accounts, organizations and repositories.
  • Don't access, change or delete other people's data. Stop as soon as you reach data that isn't yours.
  • Don't run denial-of-service tests, spam, social engineering or physical attacks.
  • Give us a reasonable chance to fix the issue before you disclose it publicly.

We won't take legal action against good-faith research that follows these rules.

Upstream is covered by Coline's privacy policy, Data Processing Addendum and subprocessor list, plus terms of its own.

Privacy policyData Processing AddendumSubprocessorsUpstream termsCopyright and takedowns

Ask us anything before you move code over. The same address takes vulnerability reports.

Email security@coline.appTalk to us about Enterprise