ON THIS PAGE
How repository access works#
Quick checks never touch your code. They only look at what your live website shows to anyone on the internet.
Full checks use the LetMeCheck GitHub App. When you install it, GitHub asks you which repositories to share. You can pick individual repositories rather than your whole account.
- Read the repositories you selected
- See basic details like repository name and default branch
- Push commits, open pull requests or change files
- See repositories you didn't select
What happens during a check#
- You choose what to check. A website address for a quick check, or one of the repositories you shared for a full check.
- We fetch what we need. For a quick check, we load your public site like a browser would. For a full check, we fetch a copy of the repository files from GitHub.
- Checks run on our scanning servers. Automated tests look for exposed keys, open database rules, risky packages and similar problems.
- Explanations are written. To turn findings into plain English and fix prompts, short excerpts around each finding may be sent to an AI provider.
- Your report is saved. Findings, scores and the excerpts needed to explain them are saved as a report in your account.
What data we access#
Where data is stored#
Your account details and reports are stored in our database. Temporary working copies of your files exist only on our scanning servers while a check runs.
How long we keep data#
- Reports stay in your account until you delete them or close your account.
- Temporary working copies of your code are used only while a check runs.
- Account details are kept while your account is open.
- Disconnecting GitHub stops future full checks straight away. Past reports stay until you delete them.
The privacy policy has the full details, including how to ask us to delete your data.
Your code after a check#
Three different things can happen to parts of your code. It's worth keeping them apart:
Security controls#
These controls are part of how LetMeCheck works today:
- GitHub access is limited to read-only permissions on the repositories you pick.
- You can remove access at any time from GitHub, under Settings → Applications.
- Shared report links can be set to expire, and turned off at any time.
- Reports are only visible to your account, and to people you share them with.
Reporting a vulnerability#
Found a security problem in LetMeCheck itself? Please tell us privately, and don't share it publicly until we've had a chance to fix it.
- What you found, and where (page, URL or feature)
- Steps to reproduce it
- What an attacker could do with it
- How we can reach you
Security questions#
Does LetMeCheck change my code?
No. The GitHub App only asks for read-only access, so it can't change files.
Can LetMeCheck push commits?
No. The app doesn't have write permission to your repositories.
Can other users see my repository?
No. Your reports are private to your account unless you share a report link.
Is my code sent to AI providers?
Short excerpts around each finding may be sent to an AI provider to write explanations and fix prompts. See "Your code after a check" above.
Where is my data stored?
In our database and, during a check, on our scanning servers. The providers are listed above.
Can I disconnect GitHub?
Yes. Uninstall the LetMeCheck app from GitHub at any time. Full checks stop straight away.
Can I delete my data?
Yes. You can delete reports, or close your account. The privacy policy explains what happens next.
How do I report a vulnerability?
Use the contact form and choose "Security report".
Read the privacy policy or the GitHub access guide for more detail. Ready to try it? Quick checks don't need any access at all.
Create a free account