Hijack Security LLC

Security

Intercept scans your source, dependencies, containers, and pipelines. That means we ask you to point a security tool at your most sensitive code — so the first thing you should know is exactly what that tool does with it, and what it never sees.

This page states what we've built, in specifics. Where we haven't built something yet, we say so. We're a first-year company; we'd rather you find the gaps here than in a demo.

How we handle your code and secrets

Most of Intercept’s analysis runs locally inside our worker. Your code leaves that boundary only when you explicitly turn on AI analysis — and even then, on your terms.

Secrets are redacted before they reach us: Secret detection runs Gitleaks with --redact. Cleartext secret values never enter the platform — we store the finding, its location, and its type, not the credential itself.
AI analysis is off until you turn it on: Before any AI feature runs, a tenant admin must explicitly choose a mode: our managed provider, your own key (BYOK), or disabled. Left unset, AI stays gated and nothing runs. Set to disabled, no code leaves the platform for AI at all.
Only one module ever sends code to an LLM: The static scanners — Syft, Grype, Gitleaks, Trivy, Semgrep, Checkov — run locally in our worker and never transmit your source. AI Insights is the single module that sends code to a language model, and only when you’ve enabled it.
The posture agent reads metadata, not contents: Our optional posture agent collects names, versions, booleans, and filenames — never the contents of your source, keys, or credentials. Its SSH collector reads only the first 64 bytes of a key to identify the key type, nothing more.
Scan credentials are short-lived and scoped to one scan: Each scan gets its own JWT with a 16-minute lifetime. Credentials are resolved fresh, re-encrypted per scan, kept out of job messages, and redacted from logs.
Worker egress is on an allowlist: Outbound traffic from the scanning worker is routed through a proxy that enforces a domain allowlist by SNI, without decrypting traffic. Anything not on the list is denied and logged.

Platform and infrastructure security

The controls behind the login, the database, and the pipeline that ships Intercept.

Authentication: Email and password, or GitHub OAuth. Passwords are hashed with bcrypt, with login hardened against timing attacks. Ten failed attempts locks the account for 15 minutes.
Password policy: Follows NIST SP 800-63B Rev. 4: a minimum length, no forced composition rules, and an optional breached-password check.
Sessions and tokens: Access tokens are short-lived JWTs paired with rotating refresh tokens, with reuse detection per OAuth 2.1 §6.1. An Active Sessions page shows every signed-in device with its IP, device, and timestamps — revoke one, or sign out everywhere.
Access control: Two per-tenant roles, Admin and Member. Tenants are isolated at the database layer with PostgreSQL Row-Level Security, backed by JWT tenant scoping as a second layer. Our threat-intelligence data runs on its own dedicated database in isolated subnets.
Encryption: In transit: TLS 1.2 floor with 1.3 supported. Stored credentials — GitHub and Azure tokens, and your BYOK provider keys — are encrypted with Fernet (AES-128-CBC with HMAC authentication).
Build and deploy pipeline: CI/CD authenticates to AWS through GitHub Actions OIDC — no long-lived cloud keys. Every service pipeline runs a Trivy image scan, and dependencies get a weekly CVE audit.
Audit trail: Authentication, user-lifecycle, scan, configuration, export, and repository-connection events are recorded in a tenant audit log with an admin view and retention purge.
Hosting: AWS, us-east-1.

Data protection and privacy

You can export or delete a tenant's data. Deletion runs as a coordinated saga across our services so records don't linger in one system after they're gone from another. If you bring your own Anthropic key, it's stored encrypted and used only for your tenant's AI analysis.

Our data processing terms and the full list of sub-processors are published — not summarized here, so they stay current.

Testing our own code

Intercept scans its own production code with Intercept, and we triage and fix what it finds. On top of that, we run a recurring adversarial testing program: monthly black-box and authenticated grey-box penetration testing, quarterly reviews of the worker, Kubernetes, AWS, and tenant isolation, and an annual white-box pass. Findings are tracked and remediated in code — the same way we'd expect a vendor to handle ours.

Reporting a vulnerability

Found something in Intercept? We publish a coordinated disclosure policy with defined scope and a good-faith safe harbor. Email security@hijacksecurity.com and you'll get an acknowledgment within two business days.

Report a vulnerability

What we have, and what’s next

We won't list certifications we don't hold. Hijack Security is in its first year, and we haven't completed a SOC 2 or ISO 27001 audit. When that changes, this page will say so with evidence, not a “coming soon” badge.

On the product side, single sign-on (SSO/SAML) and multi-factor authentication are on the roadmap; they aren't shipped today.

Running a security review?

Send security questionnaires, DPA requests, and architecture questions to security@hijacksecurity.com. A person answers — we don't hide behind a portal.

For everything else, get in touch