Security
Security and data handling
You are trusting Proofpack with the product you plan to sell. This is what it reads, what it keeps and what it never does.
Read-onlyContents and metadata only
Never runs codeFiles are read, not built
No source storedSnippets of 5 lines or fewer
Secrets maskedFirst 4 and last 2 characters
Where your code goes
Your GitHub repo
A read-only GitHub App, on the repos you choose.
Read in memory
The archive is read, checked and dropped after the scan.
Stored by Proofpack
Findings, masked snippets, scores and the report.
What Proofpack can read
- Proofpack uses a GitHub App with read-only access to contents and metadata. It cannot push, open pull requests or change settings.
- You choose the repos on GitHub. You can remove a repo or uninstall the app at any time, and reads stop at once.
- Proofpack never runs, builds or installs code from your repo. It reads files only.
What Proofpack stores
- Findings, scores, the dependency list and the report. Evidence snippets are 5 lines or fewer.
- Secrets are masked before anything is saved. A key shows as its first 4 and last 2 characters only.
- Full source files are never stored. The archive is read in memory and dropped after the scan.
- Scan progress lines are deleted after 30 days.
The AI report
- Free scans use no AI. The paid report sends a size-limited digest of the repo to Anthropic's Claude API, with secrets masked first.
- Under Anthropic's commercial terms, API data is not used to train models.
- The AI is told that repo text is untrusted and that it must not follow instructions in it. Every AI claim must name a file in the repo; claims without one are removed.
Access control
- Every database table has row-level security. Tests prove that one workspace cannot read another workspace's data.
- Sign-in uses GitHub OAuth or a one-time email link, with PKCE. Email links expire in 1 hour and work once.
- Share links use 144-bit random slugs. You can revoke a link or set it to expire. Share pages are not indexed by search engines.
Deleting your data
- In Settings you can delete one repo's data or your whole account. Deletes are immediate and cascade to every scan, report and share link.