Minimum access.
Maximum clarity.
HARIKOS is designed around explicit authorization, bounded repository analysis, revocable project access, and signed external events. This page describes implemented design principles, not certifications.
Security should be visible
where trust changes hands.
The important boundaries are explicit in the product architecture and in the user interface.
Contents: Read and Metadata: Read are the minimum repository permissions. Installation access tokens remain server-side and temporary.
Relevant files are fetched through an authorized boundary, secret paths are denied, and unnecessary raw source is not intended for permanent retention.
Sensitive server operations resolve the authenticated user and verify project ownership instead of trusting browser-supplied IDs.
Connections use high-entropy project-scoped bearer tokens. Plaintext is shown once; active access can be revoked.
GitHub webhook handlers verify signatures before marking repository state changed or triggering allowed scans.
Account access and monthly limits are enforced on the server. Historical paid status remains provider-confirmed.
Analyze what matters.
Do not become a code mirror.
The default policy is to fetch bounded relevant source, derive structured project knowledge, and persist evidence pointers and hashes instead of an arbitrary full repository copy.
SOC 2 certification
HIPAA compliance
ISO certification
Zero-retention for every data type
Perfect automated correctness
Connect your repository through explicit, inspectable boundaries.
Connect a repository and give every coding agent one current, evidence-backed understanding.