CommonGage Security Audits
Last updated: 2026-09-29
CommonGage conducts regular internal security reviews of its codebase, dependencies, secrets management, and tenant data isolation.
Audit Practice
Reviews cover:
- Codebase and dependency audits
- Secrets management practices
- Row-level security (RLS) and tenant isolation verification
- Cloudflare configuration (CORS, routing, worker bindings)
- Git history scanning for accidentally committed credentials
What runs automatically
Since 31 July 2026, several of these checks run on every proposed change and every release, rather than when someone remembers to run them:
| Check | What it proves |
|---|---|
| Type checking and test suite | The code compiles and its unit and static gates pass |
| Secret scan over full repository history | No credential has ever been committed, re-verified on every change — not merely "none in the latest commit" |
| Tenant-isolation and scope gates | Every route reading a site- or zone-scoped table applies a scope filter, or carries a written exemption |
| Documentation cross-check | These security documents still agree with the code they describe |
Two checks are not yet automated and remain periodic manual reviews: dependency vulnerability scanning and the Cloudflare configuration review.
Current Status (as of 2026-07-31)
- API (server) production dependencies: 0 vulnerabilities at any severity.
- Web application production dependencies: 2 high-severity advisories, both the same
underlying issue —
GHSA-qwww-vcr4-c8h2inreact-router, counted twice becausereact-router-domre-exports it. The advisory describes a CSRF bypass in React Router's React Server Components mode. CommonGage does not use that mode: the web application is a static single-page app with no server-side rendering and no server runtime, and it uses the declarative client-side router only. The vulnerable code path is not present in what we deploy. Remediation requires a major-version upgrade of the router, which is scheduled rather than treated as an emergency; this entry will be updated when it ships. - No secrets have ever been committed to source control — verified continuously by an automated scan over the repository's complete history, not a spot check.
- Tenant data isolation is enforced at the database level via PostgreSQL Row-Level Security, verified with integration testing.
- CommonGage has not completed a SOC 2 audit or an independent penetration test. The Security Overview describes what we do in place of those.
We publish open findings alongside resolved ones. A security page that never lists an unresolved item is not reporting; it is marketing.
For questions about our security practices, contact security@commongage.com.