Trust & Security
Your code, handled with care
MicroReview reads source code to review it, so security isn't a feature — it's the foundation. Here's exactly how we handle your data.
Data handling
- We only process the diff (changed lines) of a pull/merge request — never your full repository, branches, or history.
- Review results (findings, risk scores, metadata) are stored to power your dashboard. Your source code itself is not stored after a review completes.
- All data is encrypted in transit using TLS/HTTPS.
Credentials & encryption at rest
- OAuth access tokens are encrypted at rest with AES-256-GCM before being written to the database.
- We never ask for, store, or transmit your passwords — authentication is via GitHub/GitLab OAuth and signed webhooks only.
- The GitHub App requests the minimum permissions required: read access to code (for diffs) and write access to post review comments and check runs.
AI processing
- Only changed lines (diff hunks) are sent to our AI provider — never your entire codebase.
- Your code is not used to train AI models. The provider retains it for at most 30 days for abuse monitoring, then deletes it.
- AI-assisted actions that modify code (auto-fix) are opt-in and only ever triggered explicitly by a maintainer command.
Infrastructure
- Traffic is terminated over TLS at our edge and proxied to isolated application services.
- Webhook deliveries are verified: GitHub via HMAC signatures, GitLab via a shared secret token.
- Secrets are kept out of source control and rotated when needed.
Your controls
- Configure exactly which rules run via a .microreview.yml file in your repo.
- Risk-score badges are private by default — a numeric score is only ever shown publicly for repositories you've marked public.
- Uninstall the app at any time from your GitHub/GitLab settings to immediately revoke all access.
On our roadmap
We're an early-stage company and we're honest about it. Formal compliance certifications (e.g. SOC 2) and a self-hosted option are on our near-term roadmap. If your team has specific security requirements, we want to hear them.
Responsible disclosure
Found a vulnerability? Please email security@microreview.dev with details. We'll acknowledge promptly and keep you updated on the fix. Please give us reasonable time to remediate before public disclosure.