How your code is handled
In memory only
A snippet you submit is processed during the request and then discarded. Nothing is written to a database, a log file or disk, and there is no account system that could associate a snippet with you.
Redaction before the model sees it
Before a snippet leaves the server, obvious credential literals (passwords, API keys, tokens) and email addresses are replaced with placeholders. Redaction is a safety net, not a guarantee — do not paste real production secrets.
What the AI provider receives
The redacted snippet, the deterministic scan results and the retrieved knowledge-base excerpts are sent to the AI model that produces the review. Reviews and agent answers are returned to your browser and not retained by this application.
Prompt-injection handling
Submissions containing instruction-override patterns are rejected before any model call. Findings are always presented as model output, never as executable instructions.
This page describes application behaviour and is not legal advice.