Security policy

Report a security issue safely

A useful report identifies the affected surface and impact without exposing credentials, private source, or other people’s data.

Prepare a safe report

Do not access another customer’s account, retain unnecessary data, disrupt the service, or publish a suspected issue before a reasonable remediation opportunity.

Human sign-in is separate from GitHub authorization. Server-derived customer and repository scope cannot be granted by browser input alone.
Repository access for the current service is read-only. Provider credentials stay server-side.
A Decision binds to a source snapshot. Completion and accounting use durable records and idempotent operations so retries do not silently create another result or debit.
Likely secrets are screened before analysis, but customers should still avoid submitting secrets.

This guidance is not a certification, audit report, warranty, safe-harbor promise, bounty commitment, or approval for regulated use.
No response time or resolution time is guaranteed.