Skip to content
Allied App Security
Start free

Trust

Security & safe testing

AlliedAS is an authorized application-security platform. These are the rules the product enforces — in code, not just in policy.

Authorized targets only

  • Repositories are scanned only after you install the AlliedAS GitHub App on them.
  • Active checks require domain-ownership verification (DNS TXT record or a well-known file), a signed authorization attestation, a declared scope and an explicit opt-in.
  • A deterministic policy engine authorizes every scan and re-checks it when the scan starts. AI output can never widen what gets tested.

Bounded, non-destructive checks

  • Safe checks use read-only methods, strict request budgets and rate limits, and stay inside the URL prefixes you approve.
  • Requests to private networks and cloud metadata addresses are blocked, and DNS is pinned so a target cannot redirect traffic elsewhere.
  • We do not perform exploit chaining, credential harvesting, brute force, denial of service or destructive testing.
  • Authenticated authorization checks use dedicated test accounts you provide and a fixed, minimal number of requests.

Your data

  • Secrets found in code are masked before storage; raw values are never displayed or logged.
  • Response bodies are never stored — only hashes and short, redacted excerpts. Sensitive evidence is encrypted and expires.
  • Customer data is isolated per organization with database row-level security.
  • GitHub access uses short-lived tokens scoped to one repository. Fixes are proposed as draft pull requests; nothing is auto-merged.

Control and accountability

  • A kill switch stops active testing for an organization, project or target immediately.
  • Every security-relevant action is written to an append-only, hash-chained audit log.
  • Reports state exactly what was tested, when and at what depth. They never claim a target is “secure”.

Report a vulnerability

Found a security issue in AlliedAS? Email [email protected] with steps to reproduce. Please don’t access other customers’ data or degrade the service while testing.

Seeing AlliedAS traffic against a system you didn’t authorize? Email [email protected] with timestamps and the target host, and we will investigate and stop it.