Security and privacy
Workspace isolation and bounded source handling.
Optional analytics
When enabled, Google Analytics 4 loads only after you accept analytics cookies. It measures page visits using general page labels. We omit query parameters, repository and scan identifiers, and customer source code from the page events we send. Advertising consent stays off. You can reject analytics or withdraw consent through Cookie settings; your choice is saved in this browser. Google processes the analytics data when you opt in.
Repository access
Clerk authenticates users and selects the active workspace. Every repository, pull request, scan, engine run, observation, hypothesis, and lifecycle record is scoped to that workspace in both queries and database relationships.
Source context
Pull-request file contents are held only while a scan runs. The database stores source-free observations, bounded traces, digests, and locations—not complete changed files or repositories.
Evidence semantics
An engine observation means a named detector reported evidence. A correlated hypothesis is not verified exploitability, and AI output is never accepted as security evidence by itself.
Separate GitHub authorization
App login does not grant repository access. A workspace manager must authorize the GitHub App installation. Initial linking imports only installation repositories visible to that manager; later selection changes must arrive through signed GitHub App webhooks.
Hosted billing
Stripe Checkout and the Stripe Customer Portal collect and manage payment details. vulnatest stores Stripe customer, subscription, Price, and status identifiers for workspace entitlement; it does not receive or store complete card details.