Security
How GitGraf reaches your code, and how narrowly
Last updated 7 September 2026.
GitGraf is a small product read by a small team, and this page is written to be checkable rather than reassuring. It says what is actually true today, including the parts that are not finished.
Access to your repository
- Read-only, by construction. The GitHub App requests checks, contents, metadata, pull requests and statuses, every one of them read. There is no write permission on the App, so no bug in GitGraf can push a commit, merge a pull request, or change a setting.
- Only what you select. You choose which repositories the App is installed on, and you can change or revoke that on GitHub at any time without telling us.
- Narrowed further at the moment of use. When GitGraf scans a repository it asks GitHub for a token scoped to that one repository, with permission to read files and nothing else. It expires after an hour. A token that leaked would reach one repository for less than one hour, rather than everything you granted.
Separation between customers
Every table in the database has row level security enabled, and every view is defined to run with the permissions of the person querying it rather than its creator. Access is decided by project membership in the database itself, not by the application remembering to filter. No route accepts a project identifier from a request and trusts it.
Credentials
- The GitHub App private key is held as an environment secret on the hosting platform. It is not in the repository and not on any machine that runs code from a customer's repository.
- Connector credentials you provide are stored encrypted and read only by the server making that connector's requests.
- Tokens you create for your coding agents are stored as a digest. The value is shown once, at creation, and cannot be retrieved afterwards. You can revoke one at any time.
- All traffic is over HTTPS, with strict transport security, and the application sends the usual protective response headers.
Cloud QA
On the Pro plan, GitGraf opens your preview deployments in a real browser on a dedicated server. That browser runs in a container as a non-root user with capabilities dropped, privilege escalation disabled, and the Chromium sandbox enabled. It reaches your preview URL and nothing else of yours.
What is not built yet
Said plainly, because a security page that lists only strengths is not much use to anyone deciding whether to trust a product.
- There is no SOC 2 report, no ISO 27001 certificate and no completed third-party penetration test.
- There is no single sign-on, no SCIM and no audit log you can export.
- There is no formal bug bounty, though a report is welcome and will be answered.
- Roles are owner and member. There is no finer-grained permission model.
Reporting a vulnerability
Write to hello@gitgraf.com with enough detail to reproduce it. You will get a human reply within three working days, and an honest account of what is being done about it. Please give us a reasonable chance to fix the problem before describing it publicly. We will not take legal action against anyone who reports a problem in good faith, stays within their own account and data, and does not degrade the service for other people.
Revoking access
You do not need us. On GitHub, open Settings, then Applications, then Installed GitHub Apps, and remove GitGraf. Access ends at that moment. Deleting the project in GitGraf removes the map, the findings and the connector credentials that went with it.