Security & Trust
Your code stays yours. Minimal GitHub access, analysis in memory, and we persist derived verdicts — not your schema bodies or source code.
What CodeRifts accesses
Core Diff: schema files only
Reads your OpenAPI spec files only. The verdict is computed from the spec diff.
MigraGuard & ActionGuard (opt-in gates)
Read database migration files, application source references (scan roots configurable via .coderifts.yml, capped at 300 files / 512KB) and workflow YAML — processed in memory, never persisted.
Never credentials
No access to secrets, environment variables, or authentication tokens.
What we persist
We persist derived verdicts, risk scores and detected pattern names; structural identifiers (endpoint, path and field names); repository and PR metadata; and API-key hashes. We do not persist your schema bodies or source code from the analysis path.
Opt-in Tool Schema Registry
If you register tool schemas, they are stored — that is the registry's purpose.
Transient during analysis
Spec content passes through a work queue with a 1-hour expiry and short-lived temp files that are deleted immediately after the diff.
Usage logs: 90 days
Request metadata is kept for 90 days, then deleted automatically. IP addresses are stored only as truncated SHA-256 hashes, never in raw form; user agents are truncated.
GitHub App Permissions
CodeRifts requests the minimum permissions needed to function. Here's exactly what each permission is used for:
| Permission | Level | Why |
|---|---|---|
| Pull Requests | Write | To post analysis comments on pull requests |
| Contents | Read | To read OpenAPI spec files from the repository |
| Metadata | Read | Required by GitHub for all apps |
| Checks | Write | To create check runs with analysis status |
Data handling
No third-party telemetry
No analytics SDKs, nothing phones home — outbound connections go only to GitHub, your spec URLs and Stripe. Usage metrics stay in our own database.
No schema analytics
We don't analyze, aggregate, or learn from your API schemas.
No third-party sharing
Your data is never shared with third parties, advertisers, or AI training pipelines.
Infrastructure
Hosted on Railway
Application runs on Railway's managed infrastructure with EU/US regions.
HTTPS everywhere
All communication is encrypted in transit. No exceptions.
Hashed API keys
API keys are stored as SHA-256 hashes with per-key salts. Plaintext keys are never stored.
Rate limiting
Built-in rate limiting protects against abuse and ensures fair usage.
Install with confidence.
Minimal permissions. Read-only GitHub access. We persist derived verdicts — not your schema bodies or source code.
Install on GitHub →