Secure Development Process
How Koana is designed, built, tested and released securely.
1. Design
- Before building a feature that touches personal data or a connected service, we decide what data it needs, who may see it and the narrowest permissions required. These choices are written into the design notes.
- Privacy and access rules are enforced in the database (row-level security), not only in the interface.
- Standing rules:
- no secrets in browsers;
- connected-account keys are encrypted;
- records are archived rather than erased;
- no member data is sent to free-tier AI services.
2. Build
- Code is written in TypeScript with strict checking and kept in a private GitHub repository.
- Changes go to the main branch only after automated checks pass.
- Database changes are versioned migrations. Each new table enables row-level security, and each sensitive function checks the caller's role.
3. Verify (on every change)
- type checking, linting and automated tests;
- a production build;
- SAST: Semgrep static analysis (TypeScript/JavaScript, OWASP Top 10 and secrets rule sets);
- secret scanning with gitleaks;
- a dependency vulnerability audit; high or critical issues in production packages fail the check.
Every week, a DAST scan (OWASP ZAP baseline) runs against the live application, and automated dependency update requests are raised. Reports are kept for 90 days.
4. Release
- Releases deploy automatically from the main branch to Cloudflare, so every release is traceable to a commit.
- A release can be rolled back to the previous version in minutes.
- Secrets are injected at runtime from encrypted storage.
5. Operate and respond
Errors are monitored, and findings are fixed within the time frames in our Security policy. Incidents follow our incident response procedure.