What actually happens to your code.
Not a compliance certification — a plain-language account of what this product does and doesn't do with your code and your credentials, so you can decide for yourself whether that's enough.
Read-only, unless you say otherwise
A scan never writes anything — not to your repo, not to your branch. The only action that changes your code is "commit fix" in the editor, and that’s opt-in, per file, every time.
Every fix is a real commit
Applied fixes land as an actual git commit — either directly on the reviewed PR/MR’s branch, or on a fresh branch opened for a repo scan. Undo is git revert, not a support ticket.
Your code is not used to train any model
audit/bench does not use scanned code to train a model, ours or anyone else’s. Each scan sends the relevant code to the LLM provider configured for that request, for that single review — nothing more. Check that provider’s own API terms for their data-handling policy; we don’t control it, but standard API access (as opposed to consumer chat products) typically excludes request data from training.
Credentials are encrypted, not just hidden
GitHub and GitLab tokens are encrypted at rest with AES-256-GCM before they touch the database — not stored in plaintext behind an access check. CLI/CI API keys are never returned in any normal account response; you only ever see one right after generating or rotating it.
Passwords are hashed, not encrypted
bcrypt, cost factor 12 — and any account created under an older, lower cost factor is silently upgraded to the current standard the next time you log in.
Verified webhooks
Every inbound GitHub/GitLab webhook is checked against a per-repository secret — HMAC signature verification for GitHub, a shared-secret header for GitLab — before anything in the payload is trusted.
Your team sees your team’s data, nothing else
Scans and audits are scoped to the account that ran them, or the organization it belongs to — enforced on every query, not just in the UI. Role-based permissions control who on a team can do what.
Questions we didn't answer here?
Ask directly — especially before a security review on your end.
Contact us