Security
Reporting a vulnerability
If you believe you have found a security issue in Sinfonie, the website, or the sign-in relay, email [email protected] with “Security” in the subject. Include what you found, how to reproduce it, and the app version. We acknowledge reports within 3 business days, keep you informed while we fix the issue, and credit you if you wish. We ask that you give us reasonable time to fix before disclosing publicly, and that you do not access data that is not yours. Good-faith research within these terms will not lead to legal action. There is no paid bounty programme at this time.
How the app protects data
- Everything Sinfonie stores lives on the user’s computer. Access tokens for connected services are encrypted with the operating system keychain (Electron safeStorage on macOS).
- All network traffic uses TLS. The app talks to Slack, Jira, Linear, GitHub and AI providers directly with the user’s own credentials.
- The Slack OAuth client secret is kept only on our sign-in relay and never ships inside the application. The relay is stateless apart from the one-time authorization code, held for at most 10 minutes.
- Nothing is posted to Slack without the user pressing Send on that specific message in the app.
- The macOS build is signed with a Developer ID certificate and notarized by Apple; updates are delivered through signed releases and verified before installation.
- AI agents inside the app run with the permission mode the user chose; the on-call assistant runs read-only and cannot change files or run commands.
Scope
In scope: the Sinfonie desktop app, sinfonie.dev and its functions. Out of scope: the third-party services Sinfonie connects to (Slack, Jira, Linear, GitHub, AI providers), which have their own programmes.