Security & Trust
What CodeRifts accesses#
- Core Diff — Reads your OpenAPI spec files only. The verdict is computed from the spec diff.
- MigraGuard & ActionGuard (opt-in gates) — Read database migration files, application source references (scan roots configurable via
.coderifts.yml, capped at 300 files / 512KB) and workflow YAML — processed in memory, never persisted. - Never credentials — No access to secrets, environment variables, or authentication tokens.
What CodeRifts persists#
Derived verdicts, risk scores and detected pattern names; structural identifiers (endpoint, path and field names); repository and PR metadata; and API-key hashes. CodeRifts does not persist your schema bodies or source code from the analysis path.
- Opt-in Tool Schema Registry — If you register tool schemas, they are stored — that is the registry's purpose.
- Transient during analysis — Spec content passes through a work queue with a 1-hour expiry and short-lived temp files deleted immediately after the diff.
- Usage logs: 90 days — Request metadata is kept for 90 days, then deleted automatically. IP addresses are stored only as truncated SHA-256 hashes, never raw; user agents are truncated.
GitHub App permissions#
CodeRifts requests the minimum permissions needed to function.
| Permission | Level | Why |
|---|---|---|
| Pull Requests | Write | To post analysis comments on pull requests |
| Contents | Read | To read OpenAPI spec files from the repository |
| Metadata | Read | Required by GitHub for all apps |
| Checks | Write | To create check runs with analysis status |
Data handling#
- No third-party telemetry — No analytics SDKs, nothing phones home; outbound connections go only to GitHub, your spec URLs, and Stripe. Usage metrics stay in CodeRifts's own database.
- No schema analytics — No analyzing, aggregating, or learning from your API schemas.
- No third-party sharing — Data is never shared with third parties, advertisers, or AI training pipelines.
Infrastructure#
- Hosted on Railway — Managed infrastructure with EU/US regions.
- HTTPS everywhere — All communication encrypted in transit, no exceptions.
- Hashed API keys — Stored as SHA-256 hashes with per-key salts. Plaintext keys are never stored.
- Rate limiting — Built-in rate limiting protects against abuse and ensures fair usage.