Security & data
Security & data
A short, technical summary of how RuleFix handles your code, keys and findings. For the full picture, read Security, the Privacy Policy and Sub-processors.
On this page
What RuleFix stores
| Data | Stored? | Details |
|---|---|---|
| File contents you or your agent send | No | Analysed in memory for the request, then discarded. |
| Repository files read by a dashboard scan | No | Held in memory only while the scan runs. |
| Findings | Yes | Rule, severity, file path, line, message and fingerprint. |
| Code excerpts | Yes, encrypted | The one offending line (≤ 300 characters) with secrets redacted, encrypted per workspace. |
| Scans | Yes | Counts, score, time, source (dashboard, agent client or website), branch and commit when known. |
| API keys | Hash only | A keyed hash and a short display prefix. The full key is shown to you once. |
| GitHub user tokens | No | Used once to verify an installation, then revoked. |
File contents you or your agent send
- Stored?
- No
- Details
- Analysed in memory for the request, then discarded.
Repository files read by a dashboard scan
- Stored?
- No
- Details
- Held in memory only while the scan runs.
Findings
- Stored?
- Yes
- Details
- Rule, severity, file path, line, message and fingerprint.
Code excerpts
- Stored?
- Yes, encrypted
- Details
- The one offending line (≤ 300 characters) with secrets redacted, encrypted per workspace.
Scans
- Stored?
- Yes
- Details
- Counts, score, time, source (dashboard, agent client or website), branch and commit when known.
API keys
- Stored?
- Hash only
- Details
- A keyed hash and a short display prefix. The full key is shown to you once.
GitHub user tokens
- Stored?
- No
- Details
- Used once to verify an installation, then revoked.
Findings are engineering records about your code, not copies of it. To export or erase your own data, see your privacy controls.
Encryption
- All traffic uses TLS; the database is encrypted at rest by our hosting provider.
- Code excerpts are additionally encrypted in the application with AES-256-GCM before they reach the database, using a key derived per workspace. A ciphertext only decrypts for the same workspace and the same field, so it can't be copied into another workspace's records.
- If the encryption key isn't configured on a server, excerpts are simply not stored.
API key handling
- Keys are 32 random characters after
rf_live_. RuleFix stores an HMAC-SHA-256 of the key using a secret that lives only in the server environment, so a database copy alone can't be used to verify or guess keys. - Lookups compare hashes in constant time, and every kind of bad key gets the same 401 response.
- Keys belong to one workspace, can expire, can be revoked instantly, and their creation and revocation are audit-logged.
- Keys are never logged or echoed back.
Workspace isolation
- Row-level security in the database limits every dashboard query to workspaces you belong to.
- Scan results and issues are written only by RuleFix's servers, not directly by browsers, so recorded evidence can't be forged from the client.
- An MCP API key can only read or change projects and issues in its own workspace.
- A GitHub installation is linked to a workspace only after GitHub confirms that you can access it — see how ownership is verified.
AI fixes and your code
The rule engine itself uses no AI. An AI model is involved only when AI fixes are enabled on the server and your agent calls rulefix_suggest_fix. Then RuleFix sends a window of lines around the finding — not the whole repository — to Anthropic, with secret values replaced by placeholders first. Code and model output are not logged. Details in AI fixes.
Scanning other systems safely
- The website scanner only fetches public addresses; hosts that resolve to private or internal networks are refused, including after redirects.
- It follows robots.txt, never signs in or submits forms, and you must confirm you're responsible for a site before it is scanned.
- The GitHub App has read-only access to repository contents and metadata, for the repositories you select.
Policies and disclosure
- Security at RuleFix — our approach, what we don't claim yet, and responsible disclosure.
- Privacy Policy — what personal data we process, why, and your rights.
- Sub-processors — the providers that host and process data for RuleFix.
- Data Processing Agreement — for customers who need one.
Found a vulnerability?
Email security@rulefix.in. We acknowledge reports within 3 working days.