RedFlag reads source code to find security vulnerabilities. Because of what we do, we hold ourselves to a simple rule: we keep the least data necessary, for the shortest time necessary. This page documents how that works in practice so you can verify our claims rather than take them on trust.
How a scan handles your code
When you run a scan, your repository moves through the pipeline below:
- Fetch. We download the repository archive for the branch you selected directly from GitHub, over TLS, using the access you granted.
- Analyse in memory. The archive is unpacked and analysed in ephemeral memory only. The raw repository is never written to disk and never saved to our database.
- AI review. The most security-relevant source excerpts are sent to our AI provider (OpenAI) over TLS to run the analysis. See AI processing below.
- Discard. When the scan finishes (or fails), the in-memory copy of your source is released. The full repository does not persist anywhere on our systems.
- Store the report. We keep the resulting report - see exactly what that contains below.
What we retain vs. what we discard
We are deliberate about this distinction. We do not retain your repository; we do retain the report the scan produces, which necessarily references parts of your code.
| Data | Retained? | Detail |
|---|---|---|
| Full repository / source tree | No | Held in memory during the scan, then discarded. Never written to disk or the database. |
| Scan findings | Yes | Each finding includes the file path, line numbers, a short code excerpt relevant to the issue, and a suggested fix. |
| Repository metadata | Yes | Repository name, owner, visibility (public/private), languages, and scan coverage stats. |
| Detected secrets | Redacted | Where a hardcoded secret is found, the stored snippet is masked - we do not store the secret in full. |
| GitHub access token | Encrypted | Stored encrypted at rest (AES-256-GCM). Used only to fetch repositories you scan. Revocable anytime. |
| Account details | Yes | Your GitHub name, username, email, and avatar. |
| API keys | Hashed | Only a SHA-256 hash is stored - the key itself is shown once and never persisted in readable form. |
Because reports contain code excerpts, deleting a scan removes those excerpts too. You can delete any scan from your dashboard, and you can request full account deletion at any time (see below).
Encryption
- In transit: all traffic to RedFlag and between RedFlag and its providers (GitHub, OpenAI, Stripe) is encrypted with TLS.
- At rest: GitHub access tokens are encrypted by RedFlag with AES-256-GCM before storage, and our database provider encrypts stored data at rest.
- Secrets in reports: any detected credential is masked before the surrounding line is stored.
GitHub access
RedFlag connects to GitHub using OAuth. We request the scopes needed to identify you and read the repositories you ask us to scan: read:user, user:email, and repo. We only ever fetch a repository when you start a scan against it. You can review or revoke RedFlag's access at any time from your GitHub settings under Applications, which immediately cuts off our ability to read your code.
AI processing & model training
The analysis is performed by large language models operated by OpenAI. During a scan we transmit security-relevant source excerpts to OpenAI's API to be analysed.
- Under OpenAI's API terms, data submitted via the API is not used to train their models.
- OpenAI may retain API data for a limited period for abuse and misuse monitoring before deletion, per their policies.
- For enterprise deployments that require a formal zero-data-retention arrangement, contact us at security@useredflag.com and we will work through the options with you.
Subprocessors
We use the following third parties to operate the service. Each processes only the data described.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| OpenAI | Runs the AI security analysis | Source-code excerpts submitted during a scan | United States |
| Vercel | Application hosting & serverless compute | Request data in transit (no source code stored at rest) | United States / global edge |
| MongoDB Atlas | Primary database (accounts, scan reports, billing references) | Account details, scan findings, encrypted access tokens | European Union (Ireland) |
| Stripe | Subscription billing & payment processing | Billing contact and payment details (card data held by Stripe) | United States / global |
| GitHub | Authentication (OAuth) and repository access | GitHub profile, OAuth access token, repositories you choose to scan | United States |
| Vercel Analytics | Privacy-friendly, cookieless usage analytics | Aggregated page-view metrics only (no personal profiles) | United States |
Application security
- Authentication is handled by GitHub OAuth with server-side database sessions.
- State-changing API requests are protected against cross-site request forgery with same-origin checks.
- Scan concurrency is capped per account to bound abuse and cost.
- API keys are stored only as SHA-256 hashes and can be revoked instantly.
Data residency
Your stored data - scan reports, accounts, and encrypted tokens - is held in our database in the European Union (Ireland). Application compute runs on Vercel's infrastructure, and the AI analysis is performed by OpenAI in the United States, so source-code excerpts are transmitted there during a scan. If you have specific data-residency requirements, contact us before rolling out to your team.
Deleting your data
You can delete individual scans (and their code excerpts) from your dashboard at any time. To delete your entire account and all associated data, email privacy@useredflag.com and we will action it promptly. Revoking RedFlag's GitHub access does not delete existing reports - use deletion for that.
Reporting a vulnerability
If you believe you have found a security issue in RedFlag, please report it responsibly to security@useredflag.com. We welcome good-faith disclosure and will not pursue action against researchers who act responsibly and avoid privacy violations or service disruption.
This page describes RedFlag's current practices and is provided for transparency. For the legal terms governing personal data, see our Privacy Policy.