Understand the boundaries
Know what you are trusting with your code.
Understand public previews, saved repository analysis, provider keys and the limits of automated security checks in PrompterJack.
Ask a security questionPublic preview and saved analysis are different
The public preview processes a public repository to produce a limited health summary. Signed-in analysis stores a codebase profile in our database, plus, in object storage (R2), the raw archive for an uploaded ZIP and the extracted files up to a per-analysis cap; a GitHub import stores no raw archive, only the extracted files. Do not assume that all analysis happens only in your browser.
API keys can pass through the service
Bring-your-own-key requests are still accepted at /api/generate on the Worker: when a byok object is present in the request body, your key is relayed to your chosen provider (Anthropic, Google, or Groq) for the duration of the request and is not persisted server-side. But no bring-your-own-key model is currently selectable in the model picker, so the shipped app never routes a request that way today. Do not put keys in repository URLs, prompts, exports or public templates.
Repository access is explicit
Private repositories require authorization through a GitHub App installation. Choose the repositories granted to the installation, inspect the permissions requested, and review proposed file changes. Disconnecting the installation revokes access entirely; revoking a single repository grant without removing the whole installation is planned and not available today.
Deletion and retention need a clear expectation
Saved analysis is server-side data. Use the account and codebase controls to manage it, and contact support for questions about retained artifacts, backups or deletion completion. See the privacy policy for the applicable terms; this page is a product overview.
Security tools support a review
Scores, attack tests, rule checks and framework mappings do not certify your system or guarantee that it is free from vulnerabilities. Validate changes in your environment and seek specialist review when the consequences require it.
Enterprise features must be verified
SSO, audit-log and compliance-evidence features shown as roadmap items are not commitments of current availability. Confirm requirements with the team before making a purchasing or deployment decision.
Questions, answered
Can I upload credentials or sensitive customer data for a scan?
Remove secrets and unnecessary personal or customer data first. Grant only the access needed for the task and review the service terms and provider requirements for your intended data.