Security
How DeltaLabs limits access and protects repository processing.
Scoped access
GitHub OAuth identifies users. Repository access requires a separate GitHub App installation on repositories your organization selects. The App reads source, metadata, and pull request context and writes check results. It does not request permission to modify repository contents.
Short lived credentials
GitHub installation tokens are created for a specific installation, used for the required operation, and not stored as application data. Installation tokens are scrubbed from clone errors, and deployment secrets are kept outside customer repositories.
Tenant isolation
Service records are scoped to an organization. Database access policies check organization membership before returning repository, invariant, run, gate, or integration data.
Repository processing
Each run uses a scoped, temporary working copy of the selected repository rather than a shared customer clone. Persistent records contain the results needed to review and enforce invariants.
Model processing
DeltaLabs sends selected source context to commercial model services only when needed to produce or compare invariant candidates. DeltaLabs does not opt customer code into model training.
Report a vulnerability
Do not open a public issue or test against customer data. During private beta, report a suspected vulnerability through the private channel used for your access. Include the affected surface, steps to reproduce, and potential impact. We will acknowledge the report and coordinate next steps privately.