YOUR CODE
Why give us access to your code?
It is the right question, and the serious ones ask it. This page does not ask you to trust us. It tells you exactly what happens and gives you a way to check it yourself.
We cannot guarantee it
No audit firm can prove to you that it kept no copy. Neither can we. The same is true of the lawyer who reads your contracts and the accountant who reads your books: the relationship rests on incentive, on verification and on liability, not on proof of impossibility. Anyone who tells you "guaranteed, we will not take it" is telling you something they cannot back.
What follows is the four counterweights we can show you — and, at the end, the ones we are still missing.
Start without giving us anything
The free code check accepts public repositories only. No access, no account, no email. Put in something public — yours or anyone’s — and see whether the engine finds things worth paying for. Trust is the last step, not the first.
What exactly you give us, when you get there
You are not giving us "your GitHub". You are giving one specific thing, with specific limits:
One repository, not the account
You choose which. We do not see the others, and we do not know they exist.
Read only
We cannot write, delete, open a pull request, see your team or see your settings.
Revocable in one click
You cut it from your own settings whenever you like, without asking us and without telling us. After the audit, we are the ones who tell you to cut it.
Pinned to one version
The audit is bound to a specific commit. Anything you write afterwards, we do not see.
We are not the ones who verify this. You are.
Every time your code is cloned, GitHub writes it into your own log — not ours. You see when we came in, how many times and to which repository. If you see access that does not match an audit you asked for, you know it without asking us, and you have evidence.
Where to look: in your account or organisation, Settings → Logs → Security log (for an organisation: Settings → Audit log). Filter on `action:repo.download_zip` and `action:git.clone`.
This is not a promise from us. It is GitHub’s own record, which we do not control and cannot erase.
Where your code goes
Not to our servers
Your code never lands on the machines that run codeaudited.com. A single-use machine is built, the code goes there, and the machine is destroyed.
Deleted before the machine is
The last step of the audit deletes the code directory, even when the audit failed. The code is not kept as a build artifact and is not downloaded anywhere else.
Not even GitHub sees the key
The credential for a private repository is not passed as a parameter — it would appear in the run history. It is requested over a signed channel, masked out of the logs, and removed from the clone’s settings the moment it has been used.
We do not run your application
The code is read, not executed. We do not install your packages and we do not start your app — that would be executing someone else’s code, and we do not do it.
What we cannot promise today
The single-use machine runs on GitHub Actions infrastructure, and we do not guarantee an EU region for it. Our platform and your data stay in the EU; the audit execution does not necessarily. We write this down rather than leave it out. If you need it contractually, tell us before the audit.
What we keep when it is over
This needs to be precise, because the easy answer ("nothing") would not be true:
The findings
File, line, what is wrong, how serious it is and how to fix it. That is your report.
The excerpt that evidences each finding
Yes, that is your code — the few lines that show the problem. Without them a finding would be a claim with no proof, and you could not even dispute it.
A fingerprint of the version
So we know the certificate covers exactly this version, and so it invalidates itself when that changes.
What we do NOT keep
A copy of the repository. Your history. Files unrelated to a finding. And the raw payloads the models return — which carry source code — are erased from our database as soon as the finding is produced, in the same run. Whatever our validator rejected as invalid is kept encrypted for 30 days, so we can fix the engine when it discards good findings, and is then erased automatically too.
The AI models: what they see and what they do with it
Your code is read by models from three different companies (Anthropic, OpenAI, Google). None of them trains models on your data — the API terms we use rule it out. They may, however, retain what we send them temporarily for abuse monitoring, as their policies state: Anthropic and OpenAI for up to 30 days.
We say it because it is true. If it blocks you, tell us: there is a package with fewer models, and there are checks that run on deterministic tools alone, with no model call at all.
Why stealing it would not pay us
We do not sell applications. We sell audits, and our only asset is that people believe us. One audit earns us a few hundred or a few thousand euro. One documented theft complaint ends us — and the complaint would carry evidence, because our access is written in your own log. We are not asking you to believe in our ethics. We are showing you the arithmetic.
And something worth thinking about
If your application was written with Lovable, Cursor, Copilot or another AI tool, your code has already been read by models. If it builds on Vercel, Netlify or GitHub Actions, it has already passed through someone else’s machines. Every npm package you install runs inside it. The question is not whether anyone sees your code — it is who puts in writing what they do with it.
What we are still missing, and we write it down
- A contract with a confidentiality clause and a penalty. It is being drafted. Until it exists, what you are reading is a public commitment, not an enforceable contract — and the difference matters.
- The ability to run the audit inside your own GitHub, so the code never leaves it and only results are sent to us. We are designing it; it does not exist yet.
- A guaranteed EU region for the audit machine.
If any of these is a condition for you, say so before the audit rather than after. We would rather lose a sale than win one on a promise that does not hold.
The right first step
Do not give us access. Put a public repository into the free check and see what we find. If it is worth it, we talk afterwards.