How we handle your code

When you upload a ZIP or connect a repository, your code lands in an isolated temporary workspace on our server. Open-source analysis tools scan it there, the report is generated — and then the code is erased.

Deletion isn't a cleanup job that might be forgotten: it's built into the analysis itself and runs even when an analysis fails halfway. That applies to every path — uploaded archives, GitHub snapshots, pull-request reviews and every working copy made along the way.

What we keep is your report: scores and findings, which reference file paths and line numbers. Two honest nuances: a few performance findings include a short excerpt of the flagged line (capped at 200 characters) so you can see what was matched, and when we detect a secret we record its type and location — never the secret's value. We also never test whether a detected key is live.

Every uploaded archive goes through a safety gauntlet before analysis starts:

• ZIP-bomb detection — archives that expand more than 100× are rejected.
• Path-traversal protection — entries that try to escape their folder (../, absolute paths) are rejected.
• Symlink rejection — any symbolic link aborts the upload.
• Hard size caps — 1 GB archive, 2 GB extracted, 10,000 files max.
• Executable rejection — Windows executables and script droppers (.exe, .bat, .ps1…) abort the upload.
• A 5-minute timeout on extraction.
• Cleanup on failure — a failed extraction deletes everything it wrote, plus a final path re-check so an archive can never touch the server's own files.

MergeSafe's analysis is static analysis, run by the same industry-standard open-source scanners professional security teams use — on our own servers. There is no AI-model SDK anywhere in the analysis pipeline: your code is never sent to ChatGPT, Claude, or any other model, for any purpose, and never used to train one.

The AI-ready fix prompts in your report are generated text written for your AI assistant — producing them involves no AI and no transmission of your code.

For full transparency: during an analysis the server may download scanner rule packs (rules come down; code doesn't go up) and check that your dependencies exist on public registries by sending package names only. Your code itself is never transmitted anywhere.

Repository access goes through our GitHub App, which you install repo-by-repo with read-only access. Signing in with GitHub only proves your identity and email — it grants no repository access by itself.

• Our GitHub client is read-only by construction — the code contains no write operation at all.
• We download a one-off snapshot of the branch being analyzed — never a credentialed clone on disk.
• Every request is pinned to api.github.com — the client refuses any other destination.
• You can uninstall the app or revoke access at any time from GitHub, effective immediately.

• EU hosting — the API, the analysis engine and the database run on AWS in Stockholm, Sweden (eu-north-1).
• HTTPS everywhere — TLS certificates are auto-renewed (Let's Encrypt) and plain HTTP redirects to HTTPS.
• One door — the server firewall accepts inbound traffic on port 443 only; the SSH port is closed.
• The database is not on the internet — PostgreSQL is reachable only from inside the server's private network.
• Bounded logs — server logs rotate with a hard size cap, and the API deliberately avoids logging personal identifiers.
• Locked-down CORS — the API answers only to mergesafe.io origins, not to any website.

• No passwords, by design — sign-in is exclusively via GitHub or Google. We never see, store, or manage a password for you.
• API keys are unrecoverable secrets — 256 bits of cryptographic randomness, shown to you once, stored only as a SHA-256 hash. Rotating a key kills the old one instantly.
• Hardened session cookies — encrypted, HTTPS-only, inaccessible to JavaScript.
• Rate limiting on sensitive routes — and account deletion has its own dedicated lane, so nothing can lock you out of erasing your data.
• Deleting your account kills every session — the moment the account is gone, every previously issued login cookie stops working.

We're an early-stage product, and we'd rather under-promise: MergeSafe does not yet hold a SOC 2 or ISO 27001 certification, and we haven't commissioned a third-party penetration test. When that changes, it will be announced here.

Our guarantee is structural instead: your code is deleted after every analysis, so there is simply nothing of yours sitting on our servers to breach.

If you believe you've found a security issue in MergeSafe, please email contact@mergesafe.io — it reaches the founder directly. Give us a reasonable window to fix the issue before disclosing it publicly, and we'll credit you if you'd like.