Know what enters. Know what stays.
Source review starts with clear data boundaries. This MVP reads repository content, stores a bounded workspace snapshot and leaves the acceptance decision with its owner.
Read-only source access. No imported code execution. SofiCore does not install repository dependencies, run its scripts or change its files. Source instructions are treated as untrusted data.
Four stages. Visible controls.
- 01
Access
A signed-in owner requests a GitHub import. Public import is implemented without an App; private access is gated on a configured read-only GitHub App and authorization. Live hosted acceptance remains separate.
- 02
Analyze
Supported source is read at an immutable commit and parsed as data. Request limits, source-size bounds and owner checks constrain the operation.
- 03
Store
Source, requirements and analysis are saved together in the owner’s workspace record. Configured GitHub tokens are encrypted server-side; this is distinct from storage-provider encryption.
- 04
Remove
Settings exposes separate actions to disconnect GitHub and delete workspace data. Disconnect removes the stored token and attempts upstream revocation. Deletion removes active source, requirements and analysis records.
Ownership and consent are server decisions.
- Owner-scoped records
Private reads and writes use the signed-in identity. The client cannot choose another workspace owner.
- Protected mutations
Same-origin checks, bounded requests and per-owner rate limits guard workspace operations.
- Configured credentials
OAuth state is owner-bound, expiring and single-use. GitHub credentials stay server-side and require an encryption key.
A review build with explicit integration limits.
- Identity
- The live pilot uses Firebase Authentication. The server verifies sessions and checks the pilot access list on private requests. Newly invited email addresses must be verified; existing owner access can be approved by Firebase account ID.
- GitHub
- The read-only GitHub App has completed authorization, repository selection and a private import on soficore.space. Token refresh, revoked access and multi-account lifecycle checks remain separate acceptance tasks.
- Operations
- Vercel hosts the pilot and Firestore stores workspaces in Belgium. Active records remain until replaced or deleted. Provider backup restoration and incident drills still need operator verification. Contact info@soficore.space for support or security reports.
- Assurance
- No independent security audit or compliance certification is claimed. This build does not provide vulnerability scanning, enterprise SSO or a production service-level commitment.