Security
Scandar reads your repositories and can open pull requests, so you should know exactly what that access means. This page describes what the service does today. Scandar is in beta, and it is built and run by one person.
What Scandar can access
You choose the repositories when you install the GitHub App. Scandar sees those repositories and no others.
| Permission | Access | Why |
|---|---|---|
| Contents | Read and write | Read manifests, lockfiles, and source files. Create the branch and the commit of a fix. |
| Pull requests | Read and write | Open, merge, and close fix pull requests. |
| Checks | Read and write | Read CI before a merge, and post the Scandar check on pull requests. |
| Commit statuses | Read | Read CI before a merge. |
| Metadata | Read | Granted by default by GitHub. |
| Email addresses | Read | The email of your account at sign-in. |
A pull request needs write access to contents, so Scandar cannot be read-only. Fixes go to a new branch and a pull request. Scandar merges only when you ask it to, or when you turn on auto-merge. Auto-merge is off by default, and it refuses major upgrades and any pull request whose checks are failing, pending, or unknown.
What is stored
- Stored: your account, the repositories you connect, their manifests and lockfiles, and the scan results.
- Not stored: your source code. Source files are read during a scan to see which packages your code imports, and are not kept afterwards.
- Not sent to the AI provider: your source code, your repository name, or your email. Only public advisory text and package details are sent, as listed on the subprocessors page.
Retention and your rights are described in the privacy policy.
How it is protected
- GitHub and GitLab tokens are encrypted in the database.
- API keys are stored as a SHA-256 hash. The full key is shown once.
- Session cookies are httpOnly.
- Two-factor authentication is available on every account. The admin area refuses password accounts without it.
- New passwords are checked against known data breaches.
- GitHub webhooks are accepted only with a valid signature.
- Tokens, passwords, API keys, full emails, and lockfile contents are removed from logs.
- Pages are served with a Content Security Policy, and browsers are told to use HTTPS only.
Code from your repositories
The production server does not run files from your repositories. When a fix needs a new lockfile, the package manager runs in a disposable container with package scripts turned off.
Removing access
You can uninstall the GitHub App at any time from your GitHub settings, which ends Scandar's access to your repositories. You can download your data and delete your account from Settings.
What Scandar does not claim
Scandar has no SOC 2 or ISO 27001 certification and has not had an independent security audit. A dependency scanner reduces risk. It does not guarantee that a project is safe.
Report a flaw
Write to [email protected] and do not open a public issue. Say what the flaw allows, how to reproduce it, and whether secrets or other accounts' data are exposed. You will get a first reply within seven days, and a fix is released before any detail is published. The same contact is in security.txt.