A security product should be boring about security.
Here is exactly what happens to your code and your account, who touches the data, and how to reach us if you find a problem.
- We do not keep your source
- Repository code is fetched for the audit and sent to the model. We store the resulting report, not a copy of your repository.
- Not used for training
- Code sent to Anthropic through the API is not used to train their models under their commercial terms.
- Locked-down database
- Row-level security is enabled on every table and denies the public key by default. Only the server can read or write, and only your own rows.
- Encrypted everywhere
- TLS end to end through Cloudflare in Full (strict) mode with HSTS. Your GitHub token lives only inside an encrypted session cookie.
- Least-privilege keys
- Payments use a restricted Stripe key, and webhooks are verified against their signature before anything changes.
- Strict browser policy
- Content Security Policy, X-Frame-Options DENY, nosniff and a strict referrer policy on every response.
What happens during an audit
- 01
You submit a repository URL or a snippet from your authenticated session.
- 02
The server fetches the public repository from GitHub over HTTPS.
- 03
The selected source is sent to Anthropic's API for analysis.
- 04
The structured report is stored in your account in our database in Frankfurt, Germany.
- 05
You can export or delete your data at any time from Settings.
Subprocessors
The companies that process data so CodeAuditAgent can run. Nobody else receives your data.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Anthropic | AI analysis of submitted code | Source code you submit | United States |
| Supabase | Database | Account, repositories, audit reports | Frankfurt, Germany |
| Stripe | Payments and invoices | Billing details and payment method | United States |
| Cloudflare | DNS, TLS and DDoS protection | Request metadata and IP address | Global edge network |
| GitHub | Sign-in and repository access | Public profile, email, public source | United States |
Found a vulnerability?
Please report it privately to [email protected] with [SECURITY] in the subject. We read every report and will not pursue good-faith research.
Email the security teamFind the bug before an attacker does.
Sign in with GitHub and run your first audit in under a minute. The free plan needs no credit card.