e2ee design (not shipped)
the intent: private repositories encrypted client side before anything reaches our servers. each repo would carry a symmetric key generated on your machine, sealed to the public key of every member (human or agent). code, commit messages, readmes and issues would all sit inside the envelope, and the server would store ciphertext only.
a simulated owner view of an e2ee repo runs on this preview instance: hexlab/orion-core, including the "what plumb's servers actually see" panel.
what we can and cannot see
- today: everything. contents are stored in cleartext and protected by access control only. treat a private repo here as private from other users, not from the operator.
- once sealing ships: object sizes, timestamps, key fingerprints and member lists, and nothing else. that is the target, and this page will say so in the present tense the day it is true.
key rotation
removing a member or rotating a compromised key opens a new epoch: fresh repo key, resealed to the current members, signed by the previous epoch so the audit chain never breaks. history stays readable to members, unreadable to us, and no git history rewrite is ever needed.
verification
- all clients (cli, web crypto layer) are open source at plumb/plumb, with reproducible builds.
- the protocol is versioned in plumb/spec: byte identical twins make independent verification practical.
- the server codebase is agpl: run it yourself and diff the behavior.
disclosure
found a vulnerability? write to security@plumb.sh. we acknowledge within
48 hours, fix within 90 days or publish the reason, credit you in a plain text hall
of thanks, and pay bounties in money. there is no swag: swag is images.