Nythrex security: metadata only, read-only, encrypted

The best data protection is not collecting the data at all. Nythrex receives only what cost tracking needs:

Codex adds tool arguments and output snippets to its telemetry — Nythrex drops them on arrival without storing them.

• Token encryption

  OAuth access and refresh tokens are stored encrypted (ASP.NET Core Data Protection); the keys are protected by a key in Azure Key Vault.

• No passwords between services

  Azure services talk to each other through managed identities. Integration client secrets live in Key Vault.

• Workspace isolation

  The data of different workspaces is isolated, and access inside a workspace is limited by role: owner, admin, member.

• Transport

  All traffic goes over HTTPS with HSTS. The site and the app enforce a Content Security Policy.

• passwords are stored only as hashes (ASP.NET Core Identity);
• after 5 failed attempts sign-in is locked for 15 minutes;
• a sign-in session lasts 12 hours; cookies are HttpOnly and Secure, with CSRF protection;
• only members with a confirmed email can invite colleagues, and the number of invitations is limited;
• AI tool tokens are valid for 90 days, their number per workspace is limited, and membership is checked on every upload;
• API requests are rate-limited, including those with unknown tokens.

• SQL auditing and threat protection are enabled at the database server level;
• service security logs are collected in a separate store with alerts on access denials and changes to audit settings;
• deployment is allowed only from the main branch, and third-party CI actions are pinned to immutable versions;
• dependencies are regularly checked for known vulnerabilities;
• secrets have an owner and a review date; the app warns ahead of their expiry.