--- title: "Security" description: "How Cadence protects your code — secret and PII redaction before upload, scoped GitHub access, and enforced multi-tenancy." url: "https://teamcadence.ai/docs/security/" --- ## Secret and PII redaction Before a session ever leaves your machine, the desktop app sanitises it: secrets (API keys, tokens, credentials) and personally identifiable information are stripped from the payload locally, before upload. A second redaction pass runs server-side as well, so stored transcripts stay clean even if something local was missed. This is separate from the CLI's realtime redaction hooks (`cadence redaction install`, for agents like Claude Code, OpenCode, and Codex — see the [command reference](/docs/cli/commands/)), which redact secrets as an agent works, during the session itself rather than at upload time. The two are complementary: the hook keeps secrets out of the transcript in the first place where it's installed; upload-time redaction is the backstop that runs regardless. ## Scoped GitHub access Cadence authenticates via GitHub OAuth only — there's no separate Cadence password to leak. For repo, commit, and PR access it uses a GitHub App installed at the org level, scoped to what it actually needs: reading commit history and git notes, reading org/team membership, and posting review comments back onto pull requests. See [Orgs & repos](/docs/concepts/orgs-and-repos/) for how that maps to what gets tracked. ## Enforced multi-tenancy Every row in Cadence's database is scoped to your org, and personally-owned data (like your own sessions) carries an additional owner-scope layer that only your account can read without an explicit share. This is enforced at the data layer itself, not just hidden in the UI — see [Privacy & data](/docs/privacy/) for what that means for who can see what. ## Reporting a security issue If you find a security issue, email [[email protected]](mailto:[email protected]) rather than filing a public issue.
Docs/Security
Security
How Cadence protects your code — secret and PII redaction before upload, scoped GitHub access, and enforced multi-tenancy.
Secret and PII redaction
Before a session ever leaves your machine, the desktop app sanitises it: secrets (API keys, tokens, credentials) and personally identifiable information are stripped from the payload locally, before upload. A second redaction pass runs server-side as well, so stored transcripts stay clean even if something local was missed.
This is separate from the CLI’s realtime redaction hooks (cadence redaction install, for agents like Claude Code, OpenCode, and Codex — see the command reference), which redact secrets as an agent works, during the session itself rather than at upload time. The two are complementary: the hook keeps secrets out of the transcript in the first place where it’s installed; upload-time redaction is the backstop that runs regardless.
Scoped GitHub access
Cadence authenticates via GitHub OAuth only — there’s no separate Cadence password to leak. For repo, commit, and PR access it uses a GitHub App installed at the org level, scoped to what it actually needs: reading commit history and git notes, reading org/team membership, and posting review comments back onto pull requests. See Orgs & repos for how that maps to what gets tracked.
Enforced multi-tenancy
Every row in Cadence’s database is scoped to your org, and personally-owned data (like your own sessions) carries an additional owner-scope layer that only your account can read without an explicit share. This is enforced at the data layer itself, not just hidden in the UI — see Privacy & data for what that means for who can see what.
Reporting a security issue
If you find a security issue, email [email protected] rather than filing a public issue.