Account and security
Security and data
What code is read, where it goes, what’s kept, and how to delete it.
A short technical summary for engineers and security reviewers. The full policy is on Security & Trust and in the Privacy Policy.
What code is read#
| Where | What is read |
|---|---|
| Pull request review | The changed files at the latest commit, plus a snapshot of the repository to find callers and tests |
| Repository scan | The branch you choose, or the archive you upload |
| VS Code | The whole file you review |
| CLI | The file, folder or archive you point it at |
| Public scan | The public repository or pull request you paste |
Code is read, never run. Snapshots and archives are processed in memory for the review and then discarded.
What goes to the AI provider#
- Pull requests: the changed lines with nearby code, short excerpts of callers and related tests, and the pull request’s title and description.
- Repository scans: the functions the local checks flagged as risky, and short excerpts of core files. Never the whole repository.
- Public scans: nothing. They use local checks only.
The hosted service sends this to Google’s Gemini API. Under the API’s paid-tier terms, the data isn’t used to train models. Our servers run on Google Cloud in Europe.
What is kept#
- Reports keep findings, file paths, line numbers and short code excerpts, not copies of your repository. They stay until you delete them.
- Access tokens for GitHub, GitLab and Bitbucket are encrypted with AES-256-GCM.
- Activity logs (sign-ins and account events) are deleted after 180 days.
- Public scan visitors’ IP addresses are stored only as one-way hashes, for rate limiting.
GitHub access#
The GitHub App can read code, write pull request reviews and comments, and post a check, on the repositories you select and nothing else. It can’t push code or change settings. See permissions.
Deleting your data#
- Delete any report from its page.
- Remove a GitHub App installation from GitHub, and unlink it in the app.
- Delete your whole account from the dashboard. Reports, reviews, rules and stored tokens are deleted with it. Payment records are kept for accounting, without your account attached.
Reporting a vulnerability#
Please email hello@auditbenchai.com with details. We’ll reply as soon as we can and keep you updated until it’s fixed.