How we handle your code

Your repository is untrusted input, so the whole pipeline treats it that way.

Intake

Public GitHub repos only. We accept only https://github.com/owner/repo URLs, rebuild the URL ourselves and verify with GitHub that the repo is public. No other hosts, so no requests to internal addresses.
Limited clone. Shallow clone, size and time limits, no submodules, no Git LFS, symlinks not followed, repo hooks and config ignored.

Never executed. We don't install dependencies, build or run anything from your repo.
Isolated sandbox. Scanners run in a container with no network access, as a non-root user, with a read-only copy and CPU, memory and process limits.
Prompt-injection guard. File contents are passed to the AI as marked, untrusted data. Instructions hidden in code or comments are ignored and flagged as a finding. Links other than your GitHub repo are stripped from the AI output.