Security

Security

How we protect your code, handle GitHub access, and secure our infrastructure.

Security Highlights

In-Memory Parsing

Tree-sitter AST parsers run in isolated worker processes. We never keep persistent git clones on disk.

Encrypted at Rest & in Transit

TLS 1.3 on all connections. Database metadata and customer API keys are encrypted with AES-256.

Scoped GitHub Access

Short-lived tokens limited strictly to reading diffs and posting review comments on your PRs.

Responsible Disclosure

Direct reporting channel with rapid 24h response times and safe harbor for good-faith researchers.

SECTION 01

Architecture: Ephemeral by Default

The safest way to protect customer source code is simple: we don’t store it.

When a PR event occurs or you trigger a scan, files are fetched directly over TLS 1.3 into short-lived worker memory. Tree-sitter parsers extract functions, classes, and syntax relationships. Temporary memory buffers are cleared immediately once the review payload is generated. We never create bare git clones or store your raw repository on persistent disks.

SECTION 02

API Key & Credential Protection

If you choose to configure personal AI provider keys on the API Keys page (/apis):

  • Encrypted at Rest: Keys are encrypted with AES-256 before being written to our database.
  • Memory-Only Decryption: Keys are decrypted exclusively in memory during active API requests and are never written to disk or included in log outputs.
  • Client Protection: Raw keys are never returned to the browser in client bundles.
SECTION 03

GitHub Scopes & Network Isolation

Least Privilege Scopes

We request only read access to files (to parse syntax trees) and write access to pull requests (to post review comments). We never ask for admin rights, billing access, or repo deletion rights.

Network Isolation & DDoS

Internal databases and vector services operate in isolated virtual networks with restricted access behind Cloudflare Anycast edge proxies and automated DDoS protection.

SECTION 04

Responsible Disclosure & Reports

We welcome security reports from independent researchers and developers. If you believe you have discovered a vulnerability:

HOW TO REPORT A VULNERABILITY

Email: security@gitcaptain.com

Response SLA: Initial acknowledgment within 24 hours.

Safe Harbor: We provide safe harbor and will not take legal action against researchers acting in good faith.

Have questions about our legal or security policies?

Our engineering & compliance teams are available at legal@gitcaptain.com or through our Contact portal.