Security and Data Handling
Updated September 2026
This page describes how InkDrafts handles credentials and data. It matches the public implementation and its documented data-flow audit.
Where credentials live
The InkDrafts server holds three provider credentials: the GitHub App private key and the GitHub and Notion OAuth client secrets. They are stored as server-side Cloudflare secrets. They never reach browser code, your repository, or logs.
Token lifecycle
- Your GitHub authorization token lives for one request. It creates your repository and is then discarded. It is never written to storage, queues, or logs.
- Your Notion token is written once, encrypted, into your own repository's Actions secrets, and InkDrafts keeps no copy.
- After setup, each provisioning step mints its own short-lived token and discards it when the step ends.
The enforcement is test-enforced. The repository's canary suite plants fake
credentials, drives the real provisioning journeys, and fails if any canary
reaches storage, queue messages, logs, or responses. See
test/token-hygiene.test.ts in the repository.
Encryption
All traffic runs over HTTPS. Actions secret values are sealed with a libsodium sealed box against your repository's public key before they are sent to GitHub. Only your repository can decrypt them.
Least privilege
The InkDrafts GitHub App requests exactly these permissions: Metadata (read), Administration (write), Contents (write), Secrets (write), Actions (write), and Pages (write). Administration covers Pages setup on your repository. The App is installed on your account only, sees only the repositories you grant, and can be uninstalled by you at any time.
Retention
Setup records and the Notion template validation record are deleted after 24 hours. Operational logs are kept for at most three days. Details are in the Privacy Policy.
What this page does not claim
No security control is perfect. InkDrafts runs on GitHub, Notion, and Cloudflare and depends on their guarantees, their availability, and their incident response. InkDrafts holds no third-party security certification, and no free service should be your only backup. Your repository is yours, so your site's durability is GitHub's, not InkDrafts'.
Reporting a security problem
Please report suspected vulnerabilities privately through GitHub's “Report a vulnerability” on the InkDrafts repositories, or through Support if you cannot. Do not open a public issue with details.