Developer-tools security — token storage + supply-chain + integration scope
Devtools have customer credentials + customer source-code in scope. The Vercel Apr 2026 + Lovable Apr 2026 incidents highlight what happens when devtool security fails.
Top security risks
Customer credential storage breach
Devtools store API tokens for downstream services — compromise = mass downstream blast radius.
Supply-chain compromise (your own stack)
Devtools shipping malicious updates affect every customer immediately. Sigstore / SLSA / DSSE attestation chain required.
Integration scope creep
OAuth-app permissions widened over time; customer doesn't notice.
Customer source-code exposure
If your tool reads customer source, encrypting at rest + per-tenant isolation is non-negotiable.
Regulatory context
GDPR (EU customer data), SOC 2 (table-stakes), SLSA + Sigstore (supply chain), specialized: (out of scope — pair with a GRC platform) for federal customers.
Checklist
- Customer tokens encrypted at rest (envelope encryption)
- Sigstore / SLSA attestation chain for releases
- OAuth scope review quarterly
- Per-tenant source-code isolation
- Sub-processor list public + actively reviewed
- Run Securie on your own product
Devtool buyers ask for SOC 2 Type 2 + supply-chain attestation + per-tenant isolation guarantee + clear data-retention.