Security posture.
Exactly what Litmusly can access, why each GitHub permission exists, how your data is protected, and how to reach us about a vulnerability.
Litmusly never reads your source code
Reagents test the deployed PR preview in a browser — the same URL a human reviewer would open. The GitHub App does not request the contents permission, so it cannot read repository code, and it does not request issues, statuses, or checks. If an installation screen ever shows a permission not listed below, stop and contact us before approving.
Every GitHub permission, justified
Read reads PR metadata — the target branch and head SHA that identify the preview. Write posts the single findings comment and edits it in place on later pushes.
Finds the Vercel preview deployment for the PR and polls until it is ready. Vercel's GitHub integration populates this API.
How stored data is handled
- Webhook deliveries are verified with an HMAC SHA-256 signature before any processing.
- GitHub access tokens are minted per installation, on demand, and expire after one hour. No long-lived repo token is stored.
- Preview credentials you configure (Vercel bypass secrets, test login passwords) are encrypted at rest with AES-256-GCM. Test passwords are typed into the page deterministically and never pass through a language model.
- API keys you bring (BYOK) are encrypted at rest with AES-256-GCM.
- Walk artifacts — traces and screenshots of your preview — are retained to render run history and the PR comment.
Certification status
Litmusly is not SOC 2 certified today, and we will not claim otherwise. The controls above are what actually runs in production. For GDPR questions — what we collect, retention, deletion requests — see the privacy policy or write to us.
Reporting a vulnerability
Found a security issue? Email hello@litmusly.com with SECURITYin the subject line. Include steps to reproduce and the impact you observed. Please test only against your own installations and data — never other customers’.