Read-only by design.

What we never do

• Refund, charge, or change prices in Stripe. Money actions are outside the product.
• Edit provider settings, environment variables, or DNS on your behalf.
• Merge to production or run migrations. Repairs are proposed as pull requests and verified on a preview; a human approves.
• Store passwords. Access uses OAuth, GitHub App installations and restricted keys you can revoke at any time.

What each connection can read

• Stripe. A restricted key limited to events, webhook endpoint health and payment totals. Card numbers and customer PII are never requested.
• Vercel and Netlify. Deploy webhooks and deployment metadata. Environment variable names are compared between publishes; values are never stored.
• Supabase. OAuth with read scopes for project health, security advisors and auth configuration.
• GitHub. A GitHub App with read access to the repositories you choose, plus push and pull-request webhooks.
• OpenAI and Anthropic. Organization admin keys used only for usage and cost reads, stored with the strictest scope the provider offers.

How secrets are stored

Provider credentials are encrypted at rest with a key that lives only in the runtime secret store, never in the database or in logs. Short-lived provider tokens are used wherever a provider supports them. Secrets are redacted from logs, screenshots, traces and from every prompt sent to a model.

Journeys and screenshots

Browser journeys run in isolated, short-lived browsers with no access to your infrastructure. Test accounts and safe test payment methods are stored as secret references. Screenshots and traces are sanitized for credentials and personal data, are access-controlled per workspace, and expire on a retention schedule.

The public check

The Free Silent Failure Check performs passive checks only: it fetches public pages and headers the way a browser would, and reads at most one row when testing a leaked key so it can prove exposure without collecting data. Run it only on sites you own or are authorized to test.

Audit and retention

Every sensitive action, including connecting or revoking a provider, approving a repair and sharing a report, is recorded as an audit event with the actor and time. Observation data is retained for the history window of your tier and deleted afterwards. Deleting an app deletes its evidence.

Reporting a vulnerability

Email security@keelnest.com with the details. We acknowledge reports within two business days and never take action against good-faith research.