Security and trust at Nerudo
Nerudo is a Git forge and merge queue for people and coding agents, operated by Patrick Deutsch. This page helps developers and security teams review the service before connecting repositories or tools.
Read the product overview, privacy notice and public product source. The source and documentation let you examine specific behavior; this page is not an independent security assessment or compliance attestation.
Account and repository access
Browser sign-in establishes your Nerudo identity. It does not by itself grant access to private repositories, Git pushes or protected approvals. Repository and organization permissions govern those actions.
Browser sessions use an opaque identifier in an HttpOnly, Secure cookie. Account settings let you inspect and revoke sessions and authorized tools. Passkey private credentials remain with your authenticator.
Repository agent keys, scoped developer credentials and MCP authorizations serve different workflows. Review the permissions for the connection you are making, give it only the access it needs, and revoke it when no longer required. A developer credential is tied to its issuing account, repository, allowed operations and expiry.
Sign-in and recovery · Sessions and activity · Developer access · Agent and MCP setup
Data and service providers
Nerudo runs on Cloudflare Workers, Durable Objects and Artifacts. Cloudflare processes application requests and stores application records and repositories. Your selected identity provider handles its sign-in flow; Nerudo does not receive that provider password.
Connecting a source provider for a repository import is a separate authorization from signing in. Review the requested import access and selected repositories before proceeding. Public repository content and public contributions are visible to others; keep secrets out of them.
Account data export and deletion are available in account settings. Deletion has ownership and membership prerequisites. Shared Git history, signed receipts and copies held by other people remain. The privacy notice describes the account records and service providers; Data and deletion explains the available controls and limits.
Network review
These are the first-party public entry points. An IT team should approve the destinations and permissions needed for its intended workflow.
| Destination | Use | Connection |
|---|---|---|
nerudo.dev | Website, documentation, Git transport and repository API | HTTPS, TCP 443 |
mcp.nerudo.dev | Optional remote MCP connection and its authorization endpoints | HTTPS, TCP 443 |
Sign-in redirects, source-provider imports, customer-managed runners and coding-agent providers can require additional destinations. This table is not an exhaustive allowlist for those services. Use hostnames rather than fixed shared Cloudflare IP addresses when reviewing these entry points.
The web app sends HTTPS Strict Transport Security, content-type sniffing protection and framing restrictions. Those controls protect particular browser interactions; they do not establish that a company has approved the service or certify the safety of repository content.
Report a vulnerability or abuse
Contact the operator at patrickdeutsch@gmail.com. For a suspected vulnerability, include the affected public URL or component, reproduction steps, expected and observed behavior, and potential impact. For abusive content, include the exact public location and a description.
Do not publish credentials, private repository content or exploit details in a public issue. Use a minimal example without other people's data. This reporting channel does not grant permission to access another account, disrupt the service or perform destructive testing.
Researchers can discover the contact and policy through security.txt. General product issues belong in the public issue tracker when they contain no sensitive information.
Review the evidence
The native source repository records changes and checks. The published source snapshot and licenses provide another public reference. The scripted demonstration illustrates a workflow and is not an independent audit or customer result.
A security team can use these references to review Nerudo's purpose and implementation. Firewall classifications, search indexing and AI search inclusion are decisions made by those services; none is guaranteed by this page.