Security and privacy

RepoLantern is built so that your code, your keys and your data stay under your control.

Where your code and key go

Your model key is never stored

Your API key lives in your browser tab's memory. It is sent only with the request that needs it, and it is never written to a database, a log or a file.

Secrets are removed before any AI call

Keys, tokens, passwords and private keys found in the repository are replaced before any text is sent to a model. Repository code is never executed.

You choose where your code goes

Before a job starts, you see which provider and model will receive the code, and you agree to it. Switching to another provider later asks again.

Dependency names and versions (never code) are looked up on OSV.dev, PyPI and npm for public repositories, or when your consent says so. If you turn on web search, they are also sent, with your search key, to the search provider you chose.

Private repositories

A read-only access token is used once, for one fetch at one exact commit, and never stored.

Strict by default

The app uses no cookies; every request carries a short-lived sign-in token in a header. The public site sets analytics cookies only after you agree (analytics).
A strict Content Security Policy with Trusted Types; guides are sanitised twice before display.
Diagrams are rendered on the server and shown as images, so nothing inside them can run.
Administrators must sign in with two-step verification.
Every action is recorded in a tamper-evident audit log.
Traces hold names, ids and counts by design, never your code, prompts, answers or keys; a live test fails if code, prompt text, a bearer credential or an e-mail address reaches one. See how RepoLantern observes itself.

Red-team tested

We attack RepoLantern the way a hostile repository or visitor would, with real models and on the live service:

A hostile repository. A test repository hides instructions for AI tools: a hidden comment, a fake "SYSTEM OVERRIDE", requests to print the system prompt and to recommend curl … | sh from a hostile host. It also holds a planted access key and script markup. Documented end to end by real models (OpenAI, Anthropic Claude and Google Vertex AI), no planted instruction was obeyed, the key never reached the model, the hostile commands never appeared as steps to run, no markup could run in an export, and the guide listed every planted line by file and line.
Blind hallucination rounds. Reviewers who had not seen the checker planted invented names in real guides: 94.3% were caught in the first round and 83.3% in a harder second one, and none of 376 real names was wrongly flagged (how we check).
The live service. An OWASP ZAP baseline scan of production found no failures.
Every release. Static analysis (Semgrep, Bandit), secret scanning (gitleaks) and dependency audits stop a release on any finding.
Not yet done: an independent human penetration test. It is planned before any paid offering.

Erase everything, any time

One action deletes your guides, questions and settings. Entries about you in the audit log are encrypted with a key that is destroyed when you erase, so they can no longer be read or linked to you.

Reporting a vulnerability

Please e-mail security@aelsha.com. Our security.txt has the details. Please don't open public issues for security problems.