Data and security
Security
Mergegleam reads your code to review it. Here's exactly what we access, what we store, and what we don't.
What Mergegleam accesses
Mergegleam is installed as a GitHub App. It requests three permissions:
- read:contents: read source files in the context of the PR diff
- read:pull_requests: read PR metadata (branch, changed files, diff)
- write:reviews: post review comments inline on the PR
Mergegleam does not request write access to code, access to issues, access to settings, or any organization-level permissions. You select which repositories to enable at installation time. Access can be revoked at any time from your GitHub settings under Installed GitHub Apps.
Mergegleam uses OAuth 2.0 GitHub App authentication. No personal access tokens, no SSH keys, no service accounts.
Minimal permissions
Read code, read PRs, write reviews. Nothing else. GitHub App permissions are declared in our manifest and reviewed by GitHub during installation.
You choose which repos
Repo selection is done during GitHub App installation. You can enable or disable individual repos at any time from GitHub settings.
Revoke anytime
Uninstall the GitHub App from your organization settings and all access is removed immediately. No offboarding process required.
Transport encryption
All data in transit is encrypted via TLS 1.2+. Webhook payloads are verified using GitHub's HMAC signature validation before processing.
What we store (and what we don't)
Source code is never stored. When a PR webhook triggers a review, Mergegleam fetches the relevant files via the GitHub API into ephemeral in-memory processing. The code is analyzed and then immediately discarded. It is not written to disk, not cached, not logged.
What Mergegleam does store:
- PR metadata: repository name, PR number, head SHA, timestamp
- Review findings: file path, line number, severity tier, finding type (e.g., "null-dereference"), short description. Not the surrounding code.
- Account data: GitHub organization name, installation ID, billing status
Stored data is retained for 90 days and then purged. You can request deletion at any time by emailing [email protected].
Security practices
Mergegleam runs on cloud infrastructure (AWS) with the following practices:
- In-memory processing only during review. No code written to persistent storage.
- Processing environment is ephemeral: each review runs in an isolated container that is terminated after the review completes.
- Webhook signatures verified with HMAC-SHA256 before any payload is processed.
- All secrets (GitHub App private key, signing secrets) stored in AWS Secrets Manager, not environment variables or config files.
- Database at rest encrypted with AES-256.
- Dependencies pinned and audited. Automated dependency scanning on all upstream packages.
- Access to production infrastructure requires MFA. No shared credentials.
Third-party AI model use
Mergegleam uses a third-party large language model to perform code analysis. Code is sent to the model API for analysis and is subject to the model provider's data handling policies. We use a provider that offers a zero data retention option (data is not stored or used to train models). The provider agreement is available on request.
If your organization's policy prohibits sending code to third-party AI services, Mergegleam is not the right tool for your use case at this time. We plan to offer a self-hosted option in the future.