Home · Security
Skupa — Security Posture
Skupa is built to be pointed at production systems. This page documents how, so your security team can verify rather than trust.
Data source access is strictly read-only
- Every SQL connection string is built with
ApplicationIntent=ReadOnly,Encrypt=True(mandatory TLS), andTrustServerCertificate=False. - All queries are constant
SELECTstatements againstsys.*catalog views — the View SQL button in the app shows the exact text before you run anything. No user input is ever concatenated into SQL. - The app never issues DML or DDL of any kind.
- Dataverse access consists solely of metadata
GETrequests (entity and relationship definitions, flows, app modules) — no records are read and nothing is written.
Authentication
- Sign-in uses Microsoft Entra ID (MSAL) through the system browser; no passwords ever pass through the app.
- One shared token cache serves resource discovery and database connections; it is persisted encrypted with Windows DPAPI (current-user scope) and never leaves the machine.
- Azure Commercial and Azure Government (US) identity planes are both supported end to
end — government tenants authenticate against
login.microsoftonline.uswith government-cloud resource audiences.
Secrets at rest
| Secret | Protection |
|---|---|
| MSAL token cache | DPAPI (CurrentUser) |
| Claude API key (optional) | DPAPI (CurrentUser) + entropy |
| License/trial state | DPAPI (CurrentUser) + entropy |
No secrets are stored in plaintext, source code, or logs.
No telemetry
Skupa sends nothing home. There is no usage analytics and no update pinging. License activation is fully offline (ECDSA-signed keys verified locally). The only network calls Skupa makes are to your own Azure tenant, and — if you opt in — to your chosen AI provider.
AI integration (optional, off by default)
Nothing is sent to an AI provider unless you configure one (your own Anthropic key or your organization's Azure OpenAI endpoint) and explicitly click an AI action. What is transmitted: object names, types, dependency lists, and the SQL definition of the selected object — never credentials, tokens, or data rows.
Embedded browser
The dependency diagram renders in WebView2 locked to the bundled local page: external navigation, popups, DevTools, context menus, autofill, and host object injection are all disabled.
Reporting a vulnerability
Email sales@skupa.io with subject "SECURITY". Please report suspected vulnerabilities privately.