What code we read
- Pull request reviews: the files the pull request changes, at its latest commit. To check whether a change breaks code elsewhere, we also read a snapshot of the repository at that commit and look up where the changed functions are used.
- Repository scans: an archive of the branch you choose, to check for exposed secrets, vulnerable dependencies, licenses, dead code and risky functions.
- Pasted code: the snippet you paste into an audit.
- Code is read, never run. Archives and snapshots are processed in memory for the review and then discarded.
Where it goes, and which AI provider sees it
Free local checks (linters, type checks, secret and dependency scanners) run on our servers first. Then only the code a review needs goes to an AI model:
- Pull request reviews: the changed lines with a little surrounding code, short excerpts of the code that calls the changed functions, and the pull request’s title and description.
- Repository scans: the functions the local checks flagged as risky, plus the first 1,500 characters of up to 15 core files to judge how consistent the architecture is. Never the whole repository.
- Free public reviews on auditbenchai.com use local checks only and send nothing to an AI provider.
Provider: OpenAI, through its API (the Chat Completions endpoint), unless your workspace chooses another provider. Under OpenAI’s API data terms, data sent through the API is not used to train or improve OpenAI’s models, and OpenAI keeps request logs for up to 30 days to detect abuse. That endpoint stores no conversation state. If you choose a different provider, that provider’s API terms apply instead.
Our own servers (the Audit Bench Ai API) run on Google Cloud.
Never used for training
Your code is not used to train any model: not ours (we don’t train models) and not the AI provider’s, whose API terms exclude it.
What we keep, and what we don’t
To show you a report, we store:
- each finding: its title, explanation, severity, file path, line numbers and suggested fix, which can include a few lines of example code;
- function names and line numbers from the local checks;
- for detected secrets, the type and a masked preview, such as
AKIA…7Q, never the secret itself; - pull request details such as title, branches, merge state and CI results.
We don’t store copies of your repository or your source files. Results are cached by a fingerprint of each file, so unchanged code isn’t sent to the AI again; the cache holds findings, not your code.
The access we ask for
The GitHub App asks for the least it needs, and you choose which repositories it can see:
- Contents: read, to read the code it reviews;
- Pull requests: write, to post its review, inline comments and replies;
- Checks: write, to post the pass/fail verdict;
- Metadata: read, which every GitHub App has.
It never pushes code. The only action that changes code is Commit fix in the web editor, which you trigger yourself, file by file, with your own connected account, and which lands as a normal commit you can revert.
If you connect GitHub, GitLab or Bitbucket with a token instead, it’s encrypted at rest with AES-256-GCM and only used for the actions you start.
Deleting your data
- One report: open it and click Delete. Its findings go with it.
- Everything: Dashboard → Plan & usage → Delete account removes your account, scans, reports, audits, review rules, connected tokens and GitHub App links from our database.
- GitHub access: uninstall the app in GitHub’s settings, or disconnect a token in the app, at any time.
- Prefer to ask? Email hello@auditbenchai.com and we’ll do it for you.
How it’s built
- Passwords are hashed with bcrypt (cost factor 12), never stored or encrypted reversibly.
- Every webhook from GitHub, GitLab or Bitbucket is signature-checked against a secret before anything in it is trusted.
- Scans and reports belong to the account that ran them, or its team, enforced on every database query, not just in the interface.
- Shared report links never show where a secret is or who wrote the code.
What we don’t have yet
Audit Bench Ai is not SOC 2 certified yet. If your security review needs more than this page, such as a questionnaire, a data processing agreement or a call with the founder, email hello@auditbenchai.com.