Security

How we think about security.

Eunomio is building focused identity tools, which means trust matters early. We aim to keep each product narrow, reviewable, and operationally understandable, rather than hiding critical behavior behind a large opaque platform story.

Figure 1, operational surface
GitHub repo workflows + terraform ✓ read PR diffs changed files only ✓ read Eunomio CI Guard stateless checks PR comments + statuses AWS account no live access ✕ not reached
The product reads code and PR diffs. It does not hold live AWS credentials or mutate production identity.
01

Product scope discipline

Eunomio CI Guard stays intentionally narrow: GitHub Actions, AWS, Terraform. We avoid widening scope casually because narrow scope is part of the safety model.

02

GitHub-native workflow

The product works through the GitHub workflow teams already use: installation, pull requests, status checks, repository‑defined configuration.

03

Reviewable change path

Designed around code and pull‑request review rather than hidden runtime mutation. Every behavior change lives in a diff.

04

Minimal surface area

We prefer a small operational surface over a sprawling product surface. That includes avoiding unnecessary hosted complexity in the product loop.

Responsible disclosure

Found something? Tell us.

If you believe you found a security issue, contact us. We'll respond quickly, keep you informed during triage, and credit you if you'd like.

security@eunomio.com →