SECURITY

Know what is checked. Know what is shared.

Local checks and hosted AI reviews have different strengths and data flows. Choose deliberately, then validate the result.

Visit the Trust Center

Review the coverageEXAMPLE

01Source revisionRecorded

02Inspected files24 / 40

03Remaining filesScope disclosed

ILLUSTRATIVE SCOPE · NOT A SECURITY GUARANTEE

ON YOUR MACHINE

Local checks

The native development workflow checks diffs on your Mac using deterministic rules. Connected reporting and telemetry have separate configuration.

WHEN YOU REQUEST A REVIEW

Hosted reviews

Built-in website checks run on the AntiCode server. Selecting AI review also sends the selected pull-request diff to OpenAI.

BEFORE YOU MERGE

Human verification

A finding is a lead to investigate. A clean review is not a security certification or proof that every defect has been found.

Optional Human Review

Human Review starts with a saved pull-request review that you can access. You choose a focus and question, inspect the bounded evidence preview, and explicitly authorize sharing with AntiCode reviewers. The package includes the saved revision, coverage, file references and redacted finding explanations; it does not include repository access tokens or source files. Masking is best effort, so do not submit credentials.

An assigned person writes and publishes a dated assessment of the agreed scope and revision. Automated evidence is labeled separately and does not become a human assessment automatically. Requests are separately quoted; submitting a request makes no charge and does not change your software plan. Human Review does not certify security, approve a pull request or merge code.

Access follows your repository permissions

The website verifies your GitHub identity and repository access. Membership is revalidated on a 15-minute lease; explicit disconnection removes your workspace membership immediately. GitHub provider tokens are encrypted on the server and are not returned by dashboard APIs.

Private-repository OAuth currently uses GitHub’s broad repo scope. The dashboard reads repository and pull-request data. Optional GitHub App automation additionally posts review findings, replies and suggested edits after installation and repository opt-in. It does not commit, approve or merge code.

A review tied to a specific change

Saved reviews are matched to the pull request’s head commit, base commit, and target branch. A changed revision requires a new review. An incomplete or failed review preserves the previous successful result rather than presenting an empty result as success.

Understand the coverage boundary

Built-in checks cover a small documented set of patterns such as dynamic execution and disabled TLS verification. They are not a full static-analysis suite. AI findings require exact source references, but a valid reference cannot prove the model’s reasoning.

Repository scans can be requested from the Security dashboard. Their file and context limits are shown with each run; partial coverage is explicit. Continuous whole-repository monitoring and automatic merge enforcement are not configured. Keep your own tests, dependency analysis, secret scanning, and human review.