Security

How semarch handles your code. Last updated 12 October 2026.

What happens on a pull request

GitHub sends a signed webhook. We verify the signature, queue the scan and start an isolated container in AWS (eu-north-1, Stockholm). The container receives a GitHub installation token valid for one hour, fetches only the two commits it compares (the merge base and the head, without history), builds the architecture model and exits. Its disk is discarded with it.

What we store

• The architecture model of the pull request: file paths, module and symbol names, dependencies between them, and the file and line that justify each dependency.
• Summary counts for the comment and the check run.
• Nothing else: no file contents, no diffs of your code, no secrets from your repository.

Reports are stored encrypted in a private S3 bucket and deleted after 90 days.

Who can see a report

Public repositories: anyone with the link, like the pull request itself. Private repositories: only people who sign in with GitHub and whose own account can read the repository. We ask GitHub at view time (cached for five minutes); we do not keep our own list of members. A report for a repository you cannot read looks exactly like a report that does not exist.

GitHub App permissions

• Contents: read — to fetch the two commits being compared.
• Pull requests: write — to post and update one comment.
• Checks: write — to report the scan as a check run that never blocks merging.
• Metadata: read — required by GitHub for every App.

Secrets and access

The App's private key, webhook secret and OAuth credentials live in AWS Secrets Manager. Your GitHub sign-in token stays on our servers in a session that expires after eight hours; the browser only holds an HttpOnly, Secure session cookie.

No AI on your code

The graph, the diff and the comment are computed deterministically. Your code is not sent to any language model.

Reporting a vulnerability

Write to security@semarch.dev. We reply within two working days.