Connecting your repository lets us verify it continuously. Here is exactly what that means, in plain terms.
The app can only read. GitHub shows you the exact permissions before you install and blocks anything else at their level, so you are not relying on our word. You choose which repositories it can see, and nothing outside those.
When we scan, we pull a copy of the code into an isolated environment, run the analysis there, and destroy that environment when it finishes. The copy does not persist.
What we store is the output of the analysis: the list of tools the server exposes, its capability surface, the findings, the grade, and a fingerprint (hash) used to detect changes. We do not store your source code.
We do not keep a copy of your repository, and we do not share the internals of a private repository. Private stays private; what we publish is the verification result.
You pick the repositories, you pick the access level, and you can uninstall in one click at any time. Removing the app revokes our access immediately and takes down the badge.
The analysis is meant to be inspectable. You can review what the scanner does so you can confirm for yourself that it reads to verify and nothing more.
Monitor
Metadata and dependency information only. No source access. We watch for new releases and dependency vulnerabilities and re-verify when you ship. Safe for any repository.
Verify
Adds read access to file contents, used to analyze the source directly. Only needed for private repositories, since public source we can already read. Optional, and you can start with Monitor.
Questions before you connect? Email support@m8ven.ai.