SecurityZero-Trust Architecture

Security & Trust Center

How CodeOwl protects your codebase through ephemeral execution, zero-training commitments, and defense-in-depth isolation.

Zero Code Storage

Diffs processed in memory and wiped immediately

Zero Model Training

Your code is never used to train or fine-tune models

Least-Privilege GitHub App

No admin scopes, branch write, or secret access

Ephemeral Review Lifecycle

CodeOwl was engineered from day one on a zero-persistent-code paradigm. We treat customer source code with the highest sensitivity:

In-Memory Analysis: Diffs and related files fetched from GitHub are loaded into isolated, temporary sandbox memory solely for the duration of the review execution.
No Code Databases: We do not operate persistent databases storing your proprietary source files or repositories.
Automatic Cleanup: As soon as comments and status checks are posted to your GitHub PR, memory buffers and scratch spaces are flushed and recycled.

Zero Model Training Guarantee

Your code belongs exclusively to you and your team. Under no circumstances is customer code or PR discussions used to train, evaluate, or improve any public or foundational AI models.

Enterprise SLA Alignment: We interface exclusively with enterprise LLM endpoints bound by strict data protection agreements ensuring zero retention, zero logging of prompts, and immediate discarding post-generation.

GitHub App Security & Least Privilege

CodeOwl operates as an official GitHub App rather than an OAuth user token or Personal Access Token (PAT). This provides critical security advantages:

Permission	Level	Security Rationale
Pull requests	Read & Write	Required to read diffs and post review comments inline
Repository contents	Read-only	Used strictly to fetch import references and .owl/rules.yml
Checks	Read & Write	Reports pass/warning/fail checks back into the GitHub PR UI
Metadata	Read-only	Default GitHub permission for identifying repo name and owner

We never request repository administration, billing, secret management, or commit push permissions to source branches.

Encryption Standards & Secret Management

In Transit: All HTTP traffic is strictly served over HTTPS with TLS 1.3 enforced. Downgrade attacks are mitigated via HSTS.
Webhook Verification: Every inbound webhook from GitHub is cryptographically verified against an HMAC SHA-256 signature before processing begins.
At Rest: App keys, installation private keys, and configuration states are encrypted using AES-256-GCM.

Isolated Infrastructure & Reliability

Our review execution cluster runs in modern cloud environments with strict network segmentation, automated DDoS protection, and continuous vulnerability scanning.

Individual reviews execute in sandboxed containers isolated from other repositories.
Zero inbound open network ports on review runner nodes.
Regular automated dependency audits and container vulnerability patch cycles.

Vulnerability Disclosure & Security Contact

We take security issues seriously. If you believe you have discovered a vulnerability in CodeOwl or its GitHub App integration, please disclose it responsibly:

Direct Security Contact:

Neelesh Kurmi

Email: neeleshp212@gmail.com

Initial Response SLA: Within 24 hours

Please include detailed reproduction steps, the affected endpoints, and sample payloads. We ask that you do not publicly disclose vulnerabilities before a patch has been released.