Sangam-Git

Security

Source control is not something you experiment with. This page explains what protects your code and your account on Sangam-Git today — not on a roadmap, in the product.

Passwordless sign-in

There's no password to steal, phish, or reuse. You sign in with your email and a 6-digit code we send you. Fewer passwords means fewer of the attacks that target them.

Mandatory two-factor authentication

Every account uses two-factor authentication (2FA), and it cannot be turned off. On your first sign-in you set it up with an authenticator app — Google Authenticator, Authy, 1Password, Microsoft Authenticator — and you're asked for a 6-digit code from that app every time you sign in.

You also get one-time backup codes for when you don't have your phone. Save them somewhere safe; each works once. You can regenerate them any time from Settings → 2FA.

Some especially sensitive actions ask you to re-enter a current code even while you're signed in (step-up re-auth) — for example, creating an access token.

Session protection

Sessions are hardened against hijacking:

  • Each session is bound to the browser it was created in; if the fingerprint changes, the session is dropped.
  • Sessions expire on both an absolute and an idle timeout, so an old session can't live forever.
  • If you think a session was stolen, Sign out everywhere (under Settings → Account) ends every active session on all your devices at once.

Access tokens, not passwords, for Git

When Git needs to authenticate, you use an access token as the password — never your account login. Tokens are stored only as SHA-256 hashes (we can't read them back), can be named, and can be revoked instantly. Agent tokens are marked so their pushes are labelled (see Connect AI agents).

Encryption at rest

Sensitive fields — like your 2FA secret and webhook signing secrets — are encrypted at the application layer (AES-256-GCM) before they're stored, with the key held outside the database. A hosted Sangam refuses to start without that key.

Secret scanning that blocks the push

If you accidentally try to push an API key or private key, Sangam-Git stops the push before the secret ever lands in the repository's history. Catching it at push time means it never needs to be scrubbed from history later.

Signed webhooks

Webhook deliveries are signed. Verify the X-Sangam-Signature-256 header against your signing secret so your CI trusts only events that genuinely came from Sangam-Git, not a forged request.

Audit log

Security-relevant events — every login, token action, push, and access change — are recorded with the actor and IP address, and retained for 180 days (in line with CERT-In directions in India). View them under Settings → Audit log. This is your record of who did what, when, and from where.

Backups you can prove

One command bundles every repository and dumps the database — you run it on your own schedule — and the restore is tested: bundles are re-cloned and verified commit-for-commit. A backup you've never restored is a hope, not a backup.

Your code and AI

Your code is never used to train any AI model. AI features run only when you ask, on the specific diff, and can be turned off entirely — after which no code is sent to any model. Full details are on the Trust & data page.

In short: passwordless sign-in, unremovable 2FA, hardened sessions, hashed tokens, encrypted secrets, push-time secret blocking, signed webhooks, a 180-day audit trail, and tested backups — the fundamentals, built in.