Security at Proveta
This page explains what Proveta reads from your GitHub organisation, what it keeps, where data is processed, and how we protect it.
What we read from GitHub
The Proveta GitHub App reads only. It gets access to the repositories you select during installation, and it receives installation, repository, Dependabot alert, and push events.
| Permission | Access | Why we need it |
|---|---|---|
| Metadata | Read | Identify the repositories you select. GitHub requires it for every App. |
| Contents | Read | Download a repository snapshot for dependency and code scans. |
| Dependabot alerts | Read | Import the alerts that GitHub already found. |
| Email addresses | Read | Match a workspace invitation to your verified email address. |
Fix PRs use a separate GitHub App. It is off until a workspace admin installs it, and it is the only part of Proveta that can write to your repositories.
| Permission | Access | Why we need it |
|---|---|---|
| Contents | Read and write | Read dependency files and write the fix branch and commit. |
| Pull requests | Read and write | Open the pull request with the proposed fix. |
| Dependabot alerts | Read | Find the alert that the fix closes. |
| Metadata | Read | Identify the repository. GitHub requires it for every App. |
How a scan handles your code
A repository scan downloads one commit of the repository, up to 50 MiB and 10,000 files, into a temporary Vercel Sandbox. The scanners run in containers as an unprivileged user, with no network interface, a read-only root file system, and no Linux capabilities. Dependency resolvers reach package registries only through a proxy that allows a fixed list of registry hosts. When the scan ends, we delete the temporary files and the sandbox.
We keep the scan results: package inventories, vulnerabilities, file paths, commit references, and scan times. When code scanning is on for your workspace, each code finding also keeps its line numbers and code snippets of up to 200 characters, for the match and for up to 30 steps of its trace. We clear uploaded dependency files when their scan ends.
Proveta does not send your code or data to AI services, and it does not use them to train models. OSV receives package names, ecosystems, and versions. FIRST.org receives CVE identifiers, but not which customer is affected.
Where data is processed
| Use | Provider | Location |
|---|---|---|
| Database | Neon | AWS US East, United States |
| Website, API, scans, and fix PRs | Vercel | Washington, D.C. (iad1), United States |
| Email delivery | Resend | United States |
This infrastructure is in the United States and United States law applies to it. Transfers from the European Union use the safeguards listed on the Subprocessors page. If a public authority asks us for your data, we tell you before we answer, unless the law does not allow it, and we give data only for a request that is legally valid.
Encryption
The website and API use HTTPS. Connections to the database use TLS. Neon encrypts the stored database with AES-256.
Sign-in and access
- You sign in with GitHub, with PKCE. Proveta has no passwords.
- The session cookie is Secure, HttpOnly, and SameSite=Lax, and it lasts 30 days. We store only a SHA-256 hash of the session token.
- We do not store GitHub user tokens. Installation tokens are made for one job and one repository, and we do not store them.
- Each request names its workspace, and the server checks your membership and role before it answers.
- We check the signature of every GitHub and Stripe webhook.
- The database blocks changes to the activity history, decisions, reports, and SLA records.
Who can access your data
Only the GoStack staff who operate Proveta can access production systems. We access customer data only to give support that you ask for, to fix a problem, or when the law requires it.
Retention and deletion
We keep workspace records while your contract runs, because they are your audit history. When the contract ends, we erase them as the Terms describe. To ask for deletion earlier, email hi@gostack.dev.
Incidents
If we confirm a personal data breach that affects your workspace, we tell your workspace admins without undue delay, and no later than 48 hours after we confirm it.
Certifications
Proveta does not have a SOC 2 report or an ISO 27001 certificate yet. Email us for answers to a security questionnaire.
Report a vulnerability
Email hi@gostack.dev with the steps to reproduce the problem. We reply within 5 business days. We do not take legal action against good-faith research that follows these rules:
- Use only your own accounts and workspaces. Do not access or change other people’s data.
- Do not run denial-of-service tests, spam, or social engineering.
- Give us 90 days to fix the problem before you publish it.
We do not run a bug bounty. Our contact details are also in security.txt.