Skip to main content

Security

Security at Lectern

Lectern asks for access to your Slack, your code repository and your Search Console. This page says what it asks for, why, and who decides what happens next. It states only what Lectern's code does. It is not a certification: Lectern has no SOC 2 report.

What Lectern asks for, and why

Slack

The Slack app is installed by a workspace admin and asks for these bot permissions.

  • app_mentions:read, commandsSee when someone mentions Lectern or uses its command.
  • chat:writePost updates and approval cards.
  • channels:history, groups:history, im:historyRead replies in threads Lectern is part of and direct messages to Lectern, so it can answer them without an @mention.
  • channels:read, groups:read, channels:joinList channels for the channel picker, and join the public channel you choose for weekly reviews. Private channels only if you invite Lectern.
  • users:read, users:read.emailMatch a Slack member to a member of your Lectern team.

GitHub

You give Lectern a repository token you create yourself, scoped to one repository.

  • Contents: read and writeRead the files a change touches and commit the change to a branch Lectern creates.
  • Pull requests: read and writeOpen the pull request, and read whether your team merged it.

Google Search Console

Connected from Settings by a team member.

  • webmasters.readonly (read only)Read search queries, clicks and indexing for the sites you own, to flag problems and measure results. Lectern cannot change anything in Search Console.

Other connections are optional and off until you make them: Gmail (send and read, for outreach you approve), Google Analytics (read only), Granola and Notion (import only the meetings or pages you choose).

A person approves before anything ships

By default, Lectern does not send an outreach email, publish or change a page in your repository, or place a paid order until a person approves it. An AI agent connected over MCP cannot approve for you: these actions are refused there until you approve them in the Lectern app.

Lectern opens pull requests on its own branches and never merges them. Your team merges, through your own review and checks.

Two settings let an owner or admin give a standing yes. Both are off until someone turns them on, and both stop working if that person leaves the owner or admin role: automatic pull requests for small fixes that can be checked mechanically, and a daily batch of new pages. For the batch, your repository's own workflow decides whether to merge it.

Where data lives and how tokens are kept

Account and workspace data is kept in a Supabase database in the United States (us-west-2, Oregon), and uploaded files in Cloudflare storage. The API and scheduled jobs run on Railway in US East (Virginia). Pages are served over HTTPS with HSTS.

The repository token you provide is encrypted before it is stored, and Lectern opens it only when it reads or changes your repository. Revoke it in GitHub at any time and Lectern's access ends.

Services that handle your data

  • Hosting, storage, accounts and monitoring. Supabase (database and sign-in), Railway (API and scheduled jobs), Vercel (website), Cloudflare (file storage and bot check), Sentry (error monitoring), E2B (isolated sandboxes the agent runs in).
  • AI models. Anthropic, OpenAI, Perplexity, Google (Gemini), OpenRouter.
  • Research and search data. Firecrawl, Exa, DataForSEO, Bright Data, cloro, Brave Search, Moz, Hunter, Apollo, Unsplash, Browserbase.
  • Connections you choose. Composio (holds Google, Granola and Notion connections), Slack, GitHub.
  • Billing, email and measurement. Stripe, Resend, AgentMail, Google Ads, Google Analytics 4, Meta (Conversions API).

Lectern is operated by Waverly Ventures LLC.

Report a vulnerability

Write to hello@trylectern.com or use the contact form. Our security.txt lists the same contact. Please tell us what you found and how to reproduce it, and give us a reasonable time to fix it before you publish.