Last updated: June 2026
Security
We know you're trusting BugLens with your codebase. Here's exactly how we handle that trust.
GitHub App permissions
BugLens requests the minimum permissions required to do its job:
| Permission | Access | Why |
|---|---|---|
Pull requests | Read & Write | To read diffs and post review comments |
Contents | Read | To read .buglens.yml config from repo root |
Commit statuses | Write | To post ✅/❌ status checks on commits |
Issues | Write | To post billing limit notices as comments |
Metadata | Read | Required by GitHub for all GitHub Apps |
BugLens never requests access to your organisation's members, secrets, or settings.
Token storage
- GitHub installation tokens are encrypted at rest using AES-256-GCM with a 256-bit key
- The encryption key is stored as a secret environment variable — never in code or version control
- Tokens are decrypted only at review time and never logged
PR data handling
- Only the diff (changed lines) of a PR is sent for analysis — not full file contents
- Diffs are sent to our AI analysis provider over HTTPS. We do not retain diffs after analysis completes.
- Review findings (bug descriptions, line numbers, suggestions) are stored in our database tied to your account
- We do not use your code or diffs to train any AI model
Infrastructure
- All traffic is served over HTTPS/TLS 1.3
- Backend runs on Render (isolated containers, not shared hosting)
- Database hosted on Supabase with Row Level Security — users can only access their own data
- No SSH keys, production secrets, or credentials are stored in our GitHub repositories
What BugLens cannot do
- Cannot write code to your repository (no push access)
- Cannot access branches, tags, or commits outside of open PR diffs
- Cannot read your repository's secrets or environment variables
- Cannot access any repository you haven't explicitly installed the GitHub App on
Responsible disclosure
Found a security vulnerability? Please email satyatechgeek@gmail.com with details. We'll respond within 48 hours and credit you if you'd like.
Please do not disclose publicly until we've had a chance to investigate and patch.