6 security questions to ask before a GitHub app gets your code

Every GitHub app, code bot and AI review tool asks for repository access in a single click. That click deserves six questions.

1. Where does my code run?

Best answer: in an isolated, disposable environment per job, destroyed when the job ends. Worry if the answer is "on our servers" with no detail.

2. Is my code kept afterwards?

Ask about caches, indexes, embeddings and backups, not just "storage". Code that's been embedded into a vector store has been kept.

3. Are my tokens stored?

A tool that needs to act on your repo needs a token. The safer pattern is short-lived installation tokens requested per job, never written to a database.

4. Is my code used to train models?

The answer should be a plain no, in the terms, not just on the marketing page. Also ask about the AI providers they call: what do those providers retain?

5. How long are logs kept?

Build and test logs can contain secrets, file paths and snippets of code. There should be a number of days, and it should be short.

6. Can it push to my default branch?

The safest tools never push. They open a pull request and let a person merge.

Our answers

Here's how Versyka answers them, since it runs your build and tests to upgrade dependencies:

1. Each job runs in an isolated sandbox that's thrown away when it finishes.
2. Your code is never kept after the job.
3. Your GitHub tokens are never stored.
4. Nothing is used to train an AI model.
5. Build logs are deleted after 30 days.
6. Changes leave as a pull request. Nothing pushes to main.

The details are on versyka.com/security.

Copy the six questions into your vendor review doc. If a tool can't answer them in writing, that's your answer.