Security

Last updated:

This page says what Mergestorm can reach in your GitHub account, where your code goes, who can read it, and what we do not have yet. It describes the service as it runs today.

What we can access on GitHub

Mergestorm is three GitHub Apps. You install the ones you use, on the repositories you choose. GitHub shows each App's exact permission list when you install it.

  • Vortex (reviews) reads the code it reviews, posts reviews and check runs, and reads linked issues and commit statuses. It is installed with read-only access to your code and cannot push.
  • Cyclone (fixes) pushes fixes to your branches, including workflow files, reads and updates pull requests, and reads CI logs and commit statuses.
  • Surge (stacks, merge queue and CI runners) restacks and lands your branches, opens, updates and merges pull requests, reads, re-runs and cancels CI runs, registers runners, and sets the Actions variables that route jobs to them.

GitHub credentials

  • We act through short-lived installation tokens that GitHub issues to each App. They are held in memory and are not written to our database.
  • If you authorize the Surge App with your GitHub user, that token is stored encrypted with AES-256-GCM.

Where your code goes

  • Our review workers keep a snapshot of the repository, and Cyclone keeps a checkout. Both are deleted 7 days after they were last used.
  • Diffs, file contents, commit messages and pull request text are sent to the AI providers listed in the Privacy Policy, through their business APIs. A diff is sent as it is. We do not strip secrets from it, so a secret committed in a pull request reaches the provider.
  • Your code is not used to train models unless Share Data is on for your account.
  • Every kind of stored data and its time limit is listed under How long we keep data.

How code runs on our servers

  • Cyclone runs its patch agent and your checks in containers under gVisor, with all Linux capabilities dropped, no privilege escalation, and CPU, memory and process limits. These containers have internet access.
  • Surge servers are shared between customers. Each CI job runs in its own gVisor sandbox: a fresh container that is thrown away when the job ends.
  • Breeze chat machines run under gVisor with all Linux capabilities dropped and a read-only root filesystem.

Access to your data

  • Your browser never talks to the database. Every request goes through our API, which checks your session.
  • Every table in the database has row level security turned on.
  • API keys and app sign-in tokens are stored only as SHA-256 hashes.
  • Secrets you save in chat and connector credentials are stored encrypted with AES-256-GCM.
  • Sessions are httpOnly cookies. In Account you can see your signed-in sessions and sign out the others.
  • Webhooks from GitHub and Stripe are signature-checked before we act on them.
  • The database is Postgres hosted by Supabase in the United States (AWS us-east-1).

Who at Mergestorm can read your data

  • Admin accounts are a fixed list of named staff. For support, abuse prevention and quality work they can open accounts, chats and uploaded files.
  • Admin access is written to an append-only audit log before the request is served, and the request is refused if that write fails. Identical requests by the same admin within one minute share one entry. The log is kept for 400 days.
  • View as a customer is read-only. It is written to the same log, once per 10 minutes for the same admin and customer, and refused if that write fails.
  • Chat messages are also posted to our internal Slack workspace, as described under Support and quality review.

Deleting your account

When you delete your account, your keys and sessions are revoked at once and your subscription is cancelled. Then your chats, reviews, keys, stacks and settings are deleted, and each worker deletes its copies of your files. Reviews already posted on GitHub stay on GitHub, and Stripe keeps its own billing records.

What we do not have

  • No SOC 2 or ISO 27001 report.
  • No SAML single sign-on. Sign-in is GitHub, Google, Apple or email.
  • No two-factor step of our own. Signing in with GitHub or Google uses the one you have there.
  • No scanning of diffs for secrets before a review.
  • No paid bug bounty.

Reporting a vulnerability

Email contact@mergestorm.ai with what you found and how to reproduce it. Please do not access other customers' data or disrupt the service while testing. The same address takes security questionnaires.