Security
How we handle your code and data
We built a security scanner — it would be a strange business to run loosely with your data. Here's exactly how your code and results are handled, in plain English.
Your code is never stored
When you upload a zip, it's extracted into a temporary, isolated sandbox to run the scan. That sandbox and the uploaded file are both deleted immediately after the scan finishes — whether it succeeds, fails, or errors out partway through. We don't keep a copy of your source code anywhere, ever.
AI explanations, not AI training
The plain-English explanations in your report are generated by sending the specific finding (and a small surrounding code snippet, where relevant) to Claude. That's the only use: generating your report. Your code is never used to train or fine-tune any model.
Secrets are redacted before they ever leave your scan
When our secret scanner finds something like an exposed API key, the actual secret value is redacted before it's stored or sent anywhere else in our pipeline — including to the AI model that writes the explanation. We tell you where the problem is, not what the secret was.
Database-level access control, not just app-level checks
Your scans, findings, and reports are scoped to your account using Row Level Security at the database layer — the same class of protection our own Supabase RLS checker looks for in your project. A bug in our application code isn't enough on its own to expose another user's data.
Least-privilege service access
The background worker that runs your scan uses a scoped, server-only service credential — it's never exposed to the browser, and it's used only for what's necessary to run scans and write results.
Your Trust Badge reveals a grade, not your findings
If you choose to embed a Riskline badge on your own site, it only shows your letter grade and a short summary. It never reveals your raw findings, file paths, or any code. Sharing it is entirely your choice.
Payments never touch our servers
Billing is handled directly by Stripe. We never see or store your card number — only a customer ID and your subscription status.
Questions about any of this? Reach us at support@riskline.co.