Security

StackProof analyzes your real GitHub history to build a verifiable skill profile. That means we touch your repositories — so here is exactly what we access, what we keep, and what we never see.

Read-only, scoped access

You connect through the StackProof GitHub App and choose which repositories to grant — up to 20. The app requests read-only access to repository contents and metadata. It can never write to your repositories, open pull requests, or change settings. You can revoke access at any time from your GitHub settings.

We do not store your source code

When you select repositories, a background worker performs a shallow, blobless clone (--filter=blob:none) — it fetches commit history and file paths without downloading file contents. It reads only:

• Commit metadata — authors, dates, and changed file paths
• Dependency manifests — package.json, Cargo.toml, go.mod, requirements.txt, and similar

The clone is written to ephemeral storage and deleted immediately after analysis. We retain only the derived skill summary — skill names, commit counts, confidence scores, and activity timelines. Your source code is never persisted.

Token handling

OAuth and GitHub App installation tokens are stored server-side only and are never sent to the browser or exposed in any API response. Your login session is held in a single HTTP-only cookie (connect.sid) that JavaScript cannot read. We never see or store your GitHub password.

Encryption

All traffic to and from StackProof is encrypted with TLS (HTTPS). Data is stored in a PostgreSQL database on infrastructure we control, reachable only over the private network behind our application servers.

Data isolation

Every repository, skill, and profile record is scoped to its owning account. Read and write paths are filtered by your user id, so one account can never view, modify, or delete another account's data.

Abuse protection

Public endpoints are rate-limited, and re-analysis is capped to once per hour per repository to prevent abuse and runaway cost. Cloned repositories are size-checked before analysis.

Deletion & control

You control your data. From your dashboard you can hide your profile, remove individual repositories, export your data, or delete your account entirely. On deletion your profile is hidden immediately and all data is permanently purged after a 30-day grace window. See the Privacy Policy for details.

Reporting a vulnerability

Found a security issue? We want to hear about it. Email security@stackproof.io with details and we will respond promptly. Please give us a reasonable window to fix the issue before any public disclosure.