Privacy

Repo Spy accesses only repositories selected during GitHub App installation and only with documented read permissions.

What is accessed

Repository metadata, languages, selected manifest files, issues, pull requests, commits, contributors, releases, dependency graph data, and security alert metadata are requested to produce an analysis.

What is stored

Repository contents are not persisted in a database. Short-lived server caches may contain normalized analysis results to reduce GitHub API usage. Authentication credentials are stored only in encrypted HttpOnly cookies; installation tokens remain server-side.

Analytics

Repo Spy does not include analytics, advertising trackers, or data sales in this MVP.

Secret scanning

Literal secret values are discarded and never serialized to the browser or written to logs. Only allowlisted metadata such as secret type, state, and dates is displayed.