Security

Security is a first-class concern at TaskForce, not an afterthought. This page is a short overview and the place to report a vulnerability. The full, dated detail — architecture, data flows, compliance status and testing — lives in the Trust Center.

How we approach it

• Encryption — data in transit over TLS; sensitive fields encrypted at rest (AES-256-GCM).
• Authentication — identity through Keycloak over OIDC; SSO for enterprise deployments.
• Access control — role-based access and per-project scoping decide who can do what.
• Secrets — connector credentials are stored encrypted, never in the codebase.
• Testing — static analysis, dependency and container scanning run in our pipeline.
• AI governance — a human approves consequential steps; your data is not used to train TaskForce models.

We describe our security posture in terms of what is in place, what is planned, and what we have not done yet — no badges we haven't earned. See the Trust Center and AI transparency pages.

Reporting a vulnerability

If you believe you've found a security issue, we want to hear about it. Please email hello@taskforce.dev with the subject line “Security” and enough detail to reproduce the issue. Please give us a reasonable window to investigate and remediate before any public disclosure.

We don't currently run a paid bug-bounty program, but we're grateful for responsible disclosure and will keep you updated on our progress.