Privacy
Effective 2026-09-23
What we scan
When you submit a public repository, or install the Greenlit GitHub App on a repository, we clone the code to a temporary directory on our servers, scan it, and delete it when the scan finishes, typically within minutes. We never store your source code.
What we keep
For each scan we keep a report: the findings, each with a short evidence snippet of at most three lines from which detected secrets are redacted, plus the repository name, commit, score and verdict. Public-scan reports live at a permanent link. Gate results are posted to GitHub as check runs and are subject to GitHub's terms.
Language models
Part of the scan sends redacted code excerpts, in memory, to Anthropic's API for analysis. Detected secrets are replaced with [REDACTED] before anything is sent, and we do not retain what was sent. Anthropic's handling of API data is governed by its own terms (Anthropic Commercial Terms of Service).
Waitlist and support email
If you join the waitlist we keep your email address to send one announcement about the private-repo gate. If you email [email protected] we keep the correspondence to answer you. We do not sell or share addresses.
GitHub App data
The App receives pull-request webhooks and reads repository contents at the pull request's commit, only for the scan. Marketplace purchase status is read from GitHub and cached in memory for up to one hour; we do not store billing details.
Analytics
greenlit.sh uses Umami, a cookie-less analytics service that records page views without identifying visitors.