Security & trust
We only read what we need
Depswright works with manifest files and lockfiles. No source code. No environment credentials. No production access.
Security pillars
Minimal permissions
The GitHub App requests read-only access to contents (manifests/lockfiles only). It cannot read source code, write to branches, or access secrets. The token scope is documented in our GitHub App manifest.
No source code, ever
We analyze dependency manifests — package.json, Cargo.toml, go.mod, etc. — not your application code. We don't clone your repo. We don't see your business logic, credentials, or data.
Encrypted in transit and at rest
All communication between your CI/CD pipeline and Depswright servers uses TLS 1.2+. Stored scan data is encrypted at rest using AES-256. Encryption keys are managed per-tenant and rotated regularly.
Token management
API keys are hashed before storage. You can revoke tokens from the dashboard at any time. Tokens are scoped to specific repos and can be given expiry dates. No shared API keys.
Audit logs
Every scan, alert, and policy change is logged with timestamps, user IDs, and IP addresses. Scale plan subscribers can export audit logs for compliance review. Logs are retained for 90 days.
Responsible disclosure
Found a vulnerability in Depswright itself? Email [email protected]. We respond within 48 hours and coordinate disclosure responsibly.
Data handling
What we store and for how long
Questions about security?
Contact us directly at [email protected] — or review our Privacy Policy and Terms of Service.