What actually happens to your repository
This page states plainly what the product does, not a policy written separately from the code. Every claim below has a switch or a function behind it — the AI toggle on the profile page, the secret redaction in the audit engine, the encryption on stored tokens.
What an audit reads
An audit downloads your repository's file tree once, on our server, to run the checks and compute the score. It reads file paths and, for a small set of specific files a failed check is about (a Dockerfile, a CI workflow, .gitignore), their content. It does not execute anything in the repository.
What goes to an AI provider, and only if you leave it on
The AI step is optional and is what writes the summary paragraph and per-issue suggestions in natural language. Turn it off on the profile page and reports keep their summary and advice, written by our own rules instead of a model — nothing about the feature disappears, only the third party does.
- The failed check's name and our recommendation for it.
- Facts read from the repository: languages, frameworks, Docker base images and ports, CI workflow names, Terraform providers, the top-level file list, the first lines of the README.
- For some checks, the one configuration file the check is about — a Dockerfile, a CI workflow, a .gitignore — truncated to 4000 characters.
Never sent:
- Your source code. No check reads application code, and none is forwarded.
- Anything the secret scanner recognises. Every credential pattern it reports on is masked before sending — including in files it is not scanning. The secrets check itself sends no file at all.
- Your access tokens, which are encrypted at rest and never appear in a prompt.
Which provider that is depends on what is configured: your own key on the profile page if you set one, otherwise whichever of Anthropic, OpenAI or Google Gemini the deployment has a key for. With no key configured anywhere, or with the toggle off, nothing leaves at all and the built-in rules write the report.
Open the AI setting →How access tokens are stored
A GitHub or GitLab access token is the most sensitive thing this product holds — it can read your private source. Tokens are encrypted at rest (Fernet: AES-128-CBC with an HMAC) before they ever reach the database, with a dedicated encryption key separate from the key that signs sessions and CSRF tokens. Nothing in the codebase logs a token, and the admin panel renders every token field as "set" or "not set" — never its value, not even to us.
A connection made through the GitHub App mints a short-lived token fresh for each use rather than relying on a long-lived one — the one stored at the moment you connect is not read again afterward.
How long things are kept
Audit history is kept so the score trend on your dashboard has something to chart, and is not automatically deleted today. Removing a repository from your dashboard stops new audits and hides its history from your lists; the rows themselves, and a report reached by direct link, are kept until the account is deleted.
We are stating this as it is, not as we would like it to read: there is no automatic retention limit yet. If that matters for your compliance posture, contact us before connecting a repository you need a hard retention guarantee for.
Deleting your account
The profile page has a delete-account control that removes the account and everything tied to it in one action: connected provider accounts and their tokens, every audit and its findings, subscription and usage records, AI settings. There is no separate export or deletion request process to wait on — it happens immediately, from a page you already have access to.
Go to your profile →Who else can see repository data
- GitHub or GitLab — reading the repository you connected requires calling their API, same as any tool you authorise.
- An AI provider (Anthropic, OpenAI or Google Gemini) — only the facts listed above, and only if the AI setting is on.
- Lemon Squeezy or Cryptomus — only for the payment page, and only your billing details, never repository content.
- Nobody else. No analytics vendor and no advertising network runs on any page behind a login.
Reporting a security issue
Email support@devopsaudit.app — see also our /.well-known/security.txt for the machine-readable version. We would rather hear about a problem privately than read about it somewhere else first.