Privacy policy

What we read

Your account. Your email address, and the basic profile Google or GitHub shares when you sign in with them. Google's sign-in prompt is shown by Google, and it shares your name, email and picture with us only after you choose to continue.

Your repositories, through the GitHub App. When you install the app and select repositories, we read those repositories at a specific commit to audit them: which routes exist, what they check, and which tables they reach. We do not keep a copy of your repository. We keep what the audit concluded: route facts, findings with file paths, and short quoted lines as evidence.

Your database, if you connect it. A read-only connection to Supabase or Postgres lets us read configuration: schemas, row policies, grants and buckets. We never read the rows in your tables. Credentials are encrypted at rest (AES 256 GCM), decrypted only in memory while a check runs, and never logged. Disconnecting deletes them.

Your own AI, if you connect it. AI reasoning runs on your own AI, an agent such as Claude Code or Codex, under your account with your provider. ShipLock makes no AI calls of its own. We send your agent the task and file hashes; it reads the files from your own checkout.

Traffic, if you add the traffic snippet. For each request it reports the path, method, user agent, a visitor id the snippet computes, an optional session id, and a timestamp. Never request or response bodies, passwords, cookies or your users' data. Where we read Supabase gateway logs instead, client addresses are hashed with a daily rotating key on arrival and never kept.

Proofs. When you authorize a test, it runs on a disposable copy of your schema filled with made up data, never on your production database.

How ShipLock attacks your application

ShipLock looks for vulnerabilities by attacking your application safely. Your own AI agent proposes concrete attacks against the code at a specific commit, and must prove each one with quoted lines from the files it was given. ShipLock re-reads every quoted line before it accepts the claim, and keeps the quoted lines as the proof you see on the issue. Replays of an attack run only on a disposable copy of your schema with made up data. No attack is ever sent to your production application or your users.

Cookies

ShipLock watches its own site the way it watches yours: for each request to shiplock.dev it keeps the path, method, user agent and a salted hash of the visitor, never the address, the query string or any content. Sign-in cookies are always on because the app cannot work without them. Analytics cookies (PostHog and Google Analytics) start only after you accept them in the cookie banner. If you choose Reject, we remember it and never ask again on that browser.

Email

We send one welcome email when you create an account. Security alert emails are off today; when they open, they are sent only when something meaningful changes. We never sell or share your address.

Who processes data for us

Every third party that handles data on our behalf. We do not sell data. If this list changes, we update it here first.

Your rights

Ask us for a copy of what we hold about you, to correct it, or to delete it, at support@shiplock.dev. You can disconnect a database, revoke an AI key or agent token, remove the traffic snippet and turn off a shareable report from Settings at any time. If you need a data processing agreement, email us and we will put one in place.

Retention and deletion

We keep audit history so your dashboard can show change over time. Traffic events are kept for a limited window and then deleted automatically. To delete your account and everything tied to it, email support@shiplock.dev; this is done by hand today. Uninstall the GitHub App from GitHub as well.

See also the terms of service.