Security

Built to live in your CI.

Read PR runs inside your GitHub workflow and your reviewers' browsers. Here is what that means for your data.

Source code

Read PR never stores the contents of your code. The browser extension does not transmit diff bodies, file contents, or selections to our servers. The GitHub App reads file metadata (paths, additions, deletions) only — required to apply per-glob rules.

Reading data

We store dwell time per file, per reviewer, per pull request — and the GitHub identifiers needed to attribute it. Per-PR reading state is purged when the PR closes; aggregate reviewer history is purged 90 days later unless retention is extended for compliance.

Encryption

All traffic is TLS 1.3. Stored data is encrypted at rest with AES-256. Database backups are encrypted and access-logged.

Access control

Workspace data is partitioned by GitHub installation ID. Every API request enforces workspace membership via assertApiUser at the route boundary. Internal access is on-call only, audit-logged, and reviewed quarterly.

Extension traffic

The browser extension talks only to readpr.dev and sends file paths, seconds on screen, and the reviewer's extension token. Every request is visible in the browser's network inspector on any pull request.

GitHub App permissions

Read-only access to pull requests, contents (paths only), and checks. Write access to checks (to post the read-pr/reviewed status). No write access to code, no admin access, no secrets access.

Vendor security

Hosted on Cloudflare Workers (global edge network). Database on Neon Postgres (encrypted, point-in-time recovery). Queue, cache, and email on Cloudflare (TLS everywhere, no marketing tracking pixels).

Compliance

Read PR has not yet completed a SOC 2 audit. The controls on this page (encryption, scoped GitHub permissions, workspace isolation, audited access) are the control set we operate today, and we will share details on request. GDPR data-processing addendum available on request. HIPAA is not in scope: Read PR is not designed for protected health information.

Vulnerability disclosure

Report security issues to security@readpr.dev. We aim to acknowledge within 24 hours and triage within 72. We will credit reporters who request it. There is no paid bug bounty program yet.

Subprocessor list

GitHub (auth + webhook source), Cloudflare (hosting, queue, email, product telemetry), Neon (database), Stripe (billing), Google (Analytics 4 on marketing pages only).