Privacy policy
The short version. SecNsight reads the repositories you choose, with read-only access, to look for vulnerable packages, leaked secrets and risky code. It never runs your code and it deletes the downloaded copy as soon as the scan ends.
No code is sent to AI providers. For private repositories we keep only the findings (rule, file, line, explanation), never the lines of code. We use no advertising and no analytics.
1. Who is responsible
The service SecNsight is operated by [YOUR LEGAL NAME AND POSTAL ADDRESS]. You can reach us at info@secnsight.com. In this policy "we" means the operator.
2. What happens when you scan
- You sign in with GitHub and choose which repositories the SecNsight GitHub App may see. The access is read-only.
- When you start a scan, our server downloads a copy of that repository from GitHub into a temporary folder.
- We read the files to find dependency files, secrets and risky code patterns. We read the files; we do not execute, build or install anything from them.
- We send the names and versions of your packages to public registries and to OSV.dev to check whether they exist and whether they have known vulnerabilities (see section 5). We do not send your source code.
- No AI service is involved. SecNsight does not use AI or machine-learning services to analyse your code, and your code is not sent to any AI provider. The checks are fixed rules and the Bandit analyser.
- The temporary copy is deleted when the scan finishes. We store the result as described below.
3. What we store and for how long
| Data | Why | How long |
|---|---|---|
| GitHub numeric id and username | To create your account and sign you in | Until you delete your account |
| Sign-in and usage times, number of sign-ins and scans | To run the service, apply plan limits and spot abuse | Until you delete your account |
| GitHub access token | To list your repositories and download the ones you scan | Held in server memory only, for up to 2 hours. It is not written to the database and is revoked when you sign out or delete your account. |
| Repository files | To run the scan | Deleted when the scan ends |
| Scan results: severity, rule, file path, line, explanation and proposed remediation. Secrets are masked. | To show your report, dashboard and history | Until you delete your account. We keep your latest 200 scans. |
| The code line that matched a rule | To show evidence in the report | Public repositories and files you paste while signed in: stored with the result. Private repositories: never stored. |
| Names of repositories you scanned | To apply the repository limit of your plan | Until you delete your account |
| Dependency files you paste when you are not signed in | To produce the report | Processed in memory and not saved in the database. The report is available for 24 hours and then removed. |
| GitHub username of people who try to sign in during the closed beta without an invitation | To let us approve them | Until we approve or dismiss the request; at most the latest 200 requests are kept |
| Daily usage counters | To see overall use of the service | Counts only. They contain no names and no addresses. |
| IP address and request details in server and proxy logs | Security, rate limiting and troubleshooting | Kept for a limited time and then deleted |
Private repository names are stored so that plan limits work. The operator's admin overview hides them, but a person with technical access to the server could technically read the database.
4. Cookies and browser storage
- One session cookie keeps you signed in (up to 2 hours) and one short-lived cookie protects the GitHub sign-in. Both are strictly necessary, so no consent banner is needed for them.
- Your light or dark theme choice is saved in your browser's local storage on your device only. We do not receive it.
- We use no analytics, advertising or tracking cookies.
5. Who else receives data
- GitHub: sign-in, repository list and repository downloads.
- OSV.dev, PyPI, npm, the Go module proxy, Maven Central and NuGet: package names and versions only, to check that a package exists and whether it has known vulnerabilities.
- Google Fonts: our pages load fonts from Google, so your browser sends your IP address to Google when a page opens.
- Our hosting providers: the servers and the domain run with third-party providers who process data on our behalf.
We do not sell your data and we do not share it with anyone else, unless the law requires it.
6. Operator access
The operator can open an overview that lists account names, sign-in and scan counts, and repository names of public scans. It does not show code, findings content or the names of private repositories. We use it to run and protect the service.
7. Legal bases
If the GDPR or similar law applies to you: we process your data to provide the service you asked for (contract, Art. 6(1)(b) GDPR) and for security, abuse prevention and operating the service (legitimate interests, Art. 6(1)(f)).
8. Your rights
- Delete everything yourself. In your dashboard, use "Delete my account and data". It removes your account, scan history and tracked repositories, and revokes the GitHub token.
- You can ask us for access to your data, correction, restriction, a copy, or object to processing, by writing to info@secnsight.com.
- You can remove the app at any time in your GitHub settings under Applications.
- You may complain to your data protection authority.
9. Security
We use HTTPS, read-only GitHub access, limited cookies, masking of secrets, and we do not store private code. No system is perfectly secure and we cannot guarantee it.
10. Where data is processed
Our servers are located in Germany, in the European Union. GitHub and the registries listed above process data in their own locations.
11. Children
SecNsight is not meant for people under 18.
12. Changes
We will update this page when the service changes and change the date at the top. If a change is significant we will tell signed-in users.