How we handle your code.
We’re a security company, so our own posture should be obvious, not buried. Here’s what reaches our pipeline, what we store, what we don’t, and how to reach us if you find a problem in SecuriVibe itself.
In short
- A GitHub App with narrow permissions
- Code kept only until you delete the project
- No LLM training on your code, ever
- Found a bug in SecuriVibe? Tell us
Honest version, not the legalese. That lives in the privacy policy.
What we do, and what we don’t.
The four promises that matter most. If any of these don’t match what we’re actually doing, email us and we’ll either fix the page or fix the behaviour.
A GitHub App with narrow permissions
A scan only reads your code. If you ask for fixes as a draft pull request, the app pushes one new branch and opens the pull request. We never merge it, never change your existing branches, and can’t see your repository secrets.
Your code stays in your project
A repo is cloned into a private workspace for its scan, and an uploaded archive is stored so it can be scanned again. Both, with the results and any corrected ZIP, are kept only until you delete the project, or automatically after 30 or 90 days of inactivity if you set a retention period.
No model training. Ever.
We don’t fine-tune anything on your code. The AI checks run on Anthropic’s API, whose commercial terms prohibit training on customer inputs.
Delete it yourself, or ask us
Delete a project from its page and its code, scans and patches go with it. Email us to close your account and we’ll wipe the rest within seven days. No support-ticket gauntlet, no "export-first" hoops.
What we store, where, and for how long.
Everything we keep is in this table. If we add a column or a retention window, it lands here first.
| Data | Where it lives | How long |
|---|---|---|
| Email, name, password hash, GitHub OAuth tokens, session IP and browser | Postgres · user / account / session tables | Until account closed |
| Audit metadata (repo owner, name, status, timestamps) | Postgres · audit table | Until you delete the project, or 30/90 days after last activity if you set retention |
| Findings (title, file, line, suggestion, snippet, triage state) | Postgres · finding table | Until you delete the project, or 30/90 days after last activity if you set retention |
| Uploaded archives, patches and corrected ZIPs | Postgres · uploadArchive / fixRun tables | Until you delete the project, or 30/90 days after last activity if you set retention |
| Repository clones | Worker disk · workspace/clones/ | Deleted with the project |
| Contact requests (email, IP address, browser) | Postgres · consultationRequest | Up to 3 years from last contact |
| Free key-leak scan results (public repos, redacted matches) | Postgres · publicScan | Kept so the result link works; email us to remove |
| Run logs (AI output per check) | Worker disk · workspace/runs/ | Deleted with the project |
| Web Push subscriptions | Postgres · pushSubscriptions | Until you turn off notifications |
| Customer and order records | Polar (payment processor) · read on demand, not copied | Order records kept 7 years (UK law) |
| Cookie consent preferences | Your browser · localStorage | Per your preference; clears with browser data |
The permissions we actually use.
When you install the SecuriVibe GitHub App, you grant exactly these. You can review them under Settings → Applications → Installed GitHub Apps at any time.
Contents · Read and Write
Read to clone the repository for a scan. Write only to push a single new branch holding proposed fixes, when you ask for them as a draft pull request.
Metadata · Read
Look up the default branch and basic repo info so the scan knows which ref to check.
Pull requests · Read and Write
Read the head ref for pull-request scans, post and update our review comment with findings, and open the draft pull request of fixes.
That’s the entire list. No admin access, no secrets, no Actions.
Found something? Tell us.
If you’ve found a vulnerability in SecuriVibe itself (the site, the dashboard, the scan pipeline), email security@securivibe.com. We’ll acknowledge within 48 hours, work with you on a fix, and credit you publicly if you want it.
Safe-harbor commitment
Acting in good faith and within the bounds below means we won’t pursue legal action and won’t ask your provider to either.
- No automated scanning that disrupts service. Light, hand-paced testing only.
- Don’t access, modify, or destroy data that isn’t yours.
- Give us a reasonable window to fix before going public. We aim for a fix within 90 days.
Machine-readable contact: /.well-known/security.txt