Gearset - press

Gearset is a hopeless product from a security perspective. 

First of all, they ask the customer to open up the IP addresses to their infrastructure. Their infrastructure is completely off platform and they use a whole bunch of heterogeneous technology sets to provide some primitive devops functionality.

It’s obvious that they are targeting stupid developers who are very naïve about security OR do not care about protecting the data. 

Gearset has full access to the customer’s production org. They can not only pull metadata also full data since their application can migrate data from production instances into the developer sandboxes.

If that was not enough, they generate an OAuth token for the customers production. Once they generate the token, this store it on their own infrastructure and have full access to the token. Using this token,  Gearset can pull any data from customer’s org.  Any miserable employee from Gearset can steal the data and expose it to the world. 

It is hopeless solution from a security perspective. I’m amazed that customers are even considering their solution.