Security and your data

You are handing a security tool your source code, so you should know exactly what it keeps.

What we store

• Your GitHub account identity: id, name, public email and avatar.
• The repositories you track: owner, name and URL.
• The reports: findings, summaries, scores, the model used and which files were read.
• Your preferences: language, notification switches, watchlist terms, schedules and dismissed findings.

We do not keep a copy of your repository. Source code is read for the audit and sent to the model; what persists afterwards is the report, which includes the short excerpts quoted as evidence.

What we never ask for

We do not request write access to your repositories, and we never push code, open pull requests or change settings. We never handle your card details: payment runs entirely through Stripe.

Where it lives

Account data and reports are stored in Supabase (PostgreSQL) in the Frankfurt region, reachable only with a server-side key; the database denies direct client access. The application runs behind Cloudflare with a content security policy, strict transport security, request rate limits and an origin lock, so the server only answers traffic that came through the proxy.

Taking your data out

Settings has an export that hands you every repository and report on your account as JSON, and a deletion that removes your account, your repositories and your reports. Deletion is immediate and cannot be undone.

Reporting a vulnerability

If you find a security issue in CodeAuditAgent itself, write to [email protected]. Tell us what you found and how to reproduce it; we will confirm receipt and keep you posted while we fix it.