Security

When you run an audit, NittiM fetches a source snapshot from GitHub over HTTPS. The snapshot is held in server memory for the duration of the analysis — it is never written to disk, never stored in our database, and never logged. As soon as the analysis pipeline completes, the snapshot is gone.

To keep analysis focused and the pipeline fast, the snapshot is bounded: up to 220 files and 3.5 MB of content per audit. Binaries, build output, and dependencies are excluded before analysis begins.

Auditing a private repository requires a GitHub token. That token is forwarded to the GitHub API for the single HTTPS call that downloads the source snapshot. After that call completes, the token is discarded from memory. It is:

• —Not stored anywhere.
• —Not logged in any request or application log.
• —Not passed to Anthropic or any other downstream service.
• —Not retained between requests — each audit that needs a token must supply one.

The audit report — findings, scores, verdict, and the repository name — is stored in Supabase (managed Postgres, us-east-1) so you can retrieve it later via a shareable link or the API. Data is encrypted in transit (TLS 1.2+) and at rest.

Private repository reports are access-gated. Only the account that requested the audit — or a member of that account's organization — can retrieve the report. Requests from anyone else receive no information, including no confirmation that an audit for that id exists.

Service credentials (Supabase service-role key, Anthropic API key, GitHub token) live exclusively in Vercel environment variables. They are never committed to source control and never included in any client bundle. The audit pipeline runs entirely server-side.

Found a vulnerability? Please report it responsibly through the NittiM homepage. We respond within 48 hours and aim to patch critical issues within 7 days.