Security boundary
Limn is an early beta for public GitHub Markdown. This page states the current boundary without claiming certification, independent audit, or production guarantees.
Last updated August 9, 2026
Do not use Limn for private repositories, credentials, sensitive personal information, regulated records, or any workload that requires a certified control environment.
Controls in the current implementation
- The hosted service is intended to be accessed over HTTPS.
- GitHub OAuth is used for human sign-in; Limn does not collect a separate account password.
- The browser keeps the Limn session token in session storage rather than persistent local storage.
- API mutations require authenticated credentials and are subject to server-side authorization checks.
- Provider credentials stored by the current server implementation use application-layer encryption when the deployment is correctly configured.
These are implementation statements, not a warranty that the service is free of vulnerabilities.
Controls not offered today
Limn has not published an independent penetration test, SOC 2 report, ISO certification, compliance attestation, formal bug-bounty program, uptime guarantee, incident-notification commitment, or contractual security addendum. Private repository and self-hosted offerings are not part of the current beta.
Report a vulnerability
Submit a security report with a clear description, affected URL or component, reproduction steps, and likely impact. Do not include credentials or sensitive user data in the first message.
Please avoid destructive testing, accessing data that is not yours, social engineering, denial-of-service testing, or public disclosure before the team has had a reasonable chance to investigate. Limn does not currently promise a response or remediation deadline.