GitHub permissions
The GitHub App asks for these and nothing more. You choose which repos it can see.
| Permission | Access | Why |
|---|---|---|
contents | read | Fetch manifests and lockfiles at a ref. Nothing else is read into storage. |
metadata | read | Repo name, default branch and visibility. |
push (webhook) | event | Rescan when a manifest or lockfile changes on the default branch. |
What we never do
- Write to your repo, open pull requests or push branches
- Run your code, your tests or your install scripts
- Store your source code
- Ask for issues, pull requests, actions, secrets or admin scopes
What we store
| Data | Where | Kept |
|---|---|---|
| Manifests and lockfiles | D1 (parsed rows) and R2 (raw scan JSON) | 90 days after the scan |
| Scan results and tickets | D1 | Until you delete the repo or workspace |
| API keys | D1, SHA-256 hash only | Until revoked; shown once at creation |
| GitHub installation tokens | Memory only | Minted per job, about an hour, never persisted |
Everything runs on Cloudflare (Workers, D1, KV, R2). Registry, OSV and changelog content is treated as untrusted data: it is validated and never executed or followed as instructions.
Controls
- GitHub and Stripe webhooks are signature-verified; every request body is schema-validated.
- API keys are 32 random bytes, prefixed
pw_, compared in constant time and revocable at any time. - The public scanner is rate limited per IP and only accepts public repos.
- Secrets live in Cloudflare Workers secrets, never in code, logs or fixtures.
- Uninstalling the GitHub App stops all access immediately.
Report a vulnerability
Please contact the author privately with steps to reproduce. You will get an answer within three working days. Please do not test against other people's data.