Minimum access.
Maximum clarity.
HARIKOS is designed around explicit authorization, bounded repository analysis, revocable project access, and signed external events. This page describes implemented design principles, not certifications.
Security should be visible
where trust changes hands.
The important boundaries are explicit in the product architecture and in the user interface.
Contents: Read and Metadata: Read are the minimum repository permissions. Installation access tokens remain server-side and temporary.
Relevant files are fetched through an authorized boundary, secret paths are denied, and unnecessary raw source is not intended for permanent retention.
Sensitive server operations resolve the authenticated user and verify project ownership instead of trusting browser-supplied IDs.
Connections use high-entropy project-scoped bearer tokens. Plaintext is shown once; active access can be revoked.
GitHub and Stripe webhook handlers verify signatures before accepting repository or billing state changes.
Paid entitlement comes from trusted Stripe subscription state, never from a checkout success URL in the browser.
Analyze what matters.
Do not become a code mirror.
The default policy is to fetch bounded relevant source, derive structured project knowledge, and persist evidence pointers and hashes instead of an arbitrary full repository copy.
SOC 2 certification
HIPAA compliance
ISO certification
Zero-retention for every data type
Perfect automated correctness
Connect your repository through explicit, inspectable boundaries.
Connect a repository and give every coding agent one current, evidence-backed understanding.