Project isolation
Each MCP token is bound to one project. Session users resolve access through account roles and explicit project grants.
Security
Clear boundaries for people, projects, and agents.
Pulsyr handles authentication, API tokens, project data, and inbound webhooks. Its controls reduce accidental cross-project access, while operators remain responsible for infrastructure, secrets, backups, and upgrades.
Credential handling
Raw MCP tokens appear once and are stored as hashes. Production startup rejects placeholder or short session secrets.
Signed integrations
Sentry and GitHub webhooks support signature verification. Configure a unique secret for every external integration.
Supported release
Only the latest tagged release receives security fixes. Upgrade before reporting or reproducing an issue.
Report a vulnerability privately.
Do not open a public issue for a security problem. Use GitHub's private vulnerability reporting from the repository Security tab. Include the affected area, reproducible steps or proof of concept, and the impact you believe an attacker could achieve.
Operator responsibilities
- Terminate TLS at a maintained reverse proxy.
- Keep
DEBUG=falsein production. - Use unique secrets and restrict database/network access.
- Back up Postgres and test restoration.
- Monitor releases and apply security updates.