Encrypted Token Vault
AES-256-GCM encryption, per-tenant keys, and minimal OAuth scopes for connector credentials.
Integrations (GitHub, GitLab, Vercel, Netlify, Neon, Supabase) need access tokens to act on your behalf. BhaiCode keeps those credentials in the Encrypted Token Vault.
Encryption standards
- AES-256-GCM at rest: access tokens, refresh tokens, and API keys are encrypted with an authenticated cipher.
- Per-tenant keys: keys are derived per tenant with secure key-derivation functions (PBKDF2 / HKDF).
- No plaintext storage: tokens never appear in plaintext in databases, caches, or logs.
- TLS 1.3 in transit: traffic between your client, the BhaiCode API, and third-party services is encrypted.
Least privilege
BhaiCode requests the minimum OAuth scopes a connector needs. If a connector asks for more than you expect, stop and check the consent screen.
Was this page helpful?