Security

We ask for repository access. Here is exactly what we do with it.

Short, specific and checkable. If anything on this page stops being true, the page changes first.

• GitHub App permissions

  Repairs run through a GitHub App you install on the repositories you choose. It asks for contents (write), pull requests (write), checks (write) and metadata (read), and subscribes to installation, push and pull request events. Nothing outside the selected repositories is visible to it. Uninstalling the app revokes access at once.

• Your live branch is never written to

  A repair downloads a snapshot of the repository into a temporary directory, applies a deterministic transform for the findings you chose, commits to a new branch and opens a pull request. The default branch is never pushed to. The temporary directory is deleted when the run ends, whether it succeeded or not.

• What an audit stores

  The sampled URLs, their response headers and extracted metadata, each finding with its evidence, and the summary shown on the report. Page bodies are not retained beyond the run. Audits belong to a workspace and are visible only to its members; a preview report is visible to whoever holds its link, which is unguessable.

• Payments

  Checkout, cards and invoices are handled by Dodo Payments as merchant of record. BulkAudits never sees card numbers. Access to a plan is granted only when the payment webhook confirms it, never on the strength of a redirect.

• Accounts and sign-in

  Authentication is provided by Supabase Auth with Google sign-in or email and password. Sessions are cookie based and scoped to this site. Workspace data is protected by row-level security policies in the database, so a query from one workspace cannot read another.

• Deleting your data

  Email support from the address on the account and the workspace, its audits, findings and repair records are deleted. Uninstall the GitHub App to remove repository access immediately; the pull requests it opened stay in your repository, under your control.