Trust
An agent you can check, not one you have to trust
Every claim on this page is backed by a document we publish: the security reference, the DPA, the privacy policy, or the policy file that bounds what the agent may do in your repository.
If it isn't logged, it didn't happen
The audit log is append-only. The agent has no path to revise its own history. That single property is what makes the rest of this page checkable rather than reassuring: you do not have to believe that the agent stayed inside its scopes, you can read what it did, in order, with the input, the output and the reason for each step.
The boundary
Where each step runs, and what it leaves behind
Coding runs on your machine, triage and the merge run on our side, every model call uses your own key, and the audit log records the request, the triage verdict and the merge.
- the task
- a model call on your key
- an audit row, append-only
- merged past the merge gate
What keeps your code and keys safe
The App scopes, in full
The complete list of scopes the GitHub App requests is on the App page at github.com/apps/developerz-ai. Check it against this claim before you install. It can push a branch, merge a PR once CI and the review gate pass, and cut a release when your maintainer.yml asks for one. It does not request administration or secrets, so it cannot change repository settings, read your Actions secrets, or manage access.
BYOK, your provider account
Inference runs on your own key (Anthropic, OpenAI, Gemini, DeepSeek, Kimi, GLM, MiniMax and more, or any OpenAI-compatible endpoint) under your own data-handling terms. We never resell tokens and we are not a reseller in the call path.
Secrets encrypted at rest
Stored credentials are encrypted at rest and decrypted in memory only at the moment of use. They are never written to logs or to audit events.
An append-only audit log
Every action is recorded with actor, repository, kind, input, output and timestamp, appended and never updated or deleted afterwards.
No bot-on-bot loops
CodeRabbit, Copilot, Dependabot and Renovate are recognised by identity and never answered, so two bots never end up arguing on one thread. Dependabot and Renovate PRs are still reviewed, fixed and merged through the merge gate.
The documents behind it
Read the details, not the summary
- Security reference
The exact GitHub scopes, the encryption scheme, the audit-log fields and how to report a vulnerability.
- BYOK
Which providers are supported, how keys are stored, and what leaves your account when the agent runs.
- Data processing addendum
The processor terms: what we process, on what basis, for how long, and with which sub-processors.
- Privacy policy
What we collect from you and from your repositories, and what we do not collect at all.
- maintainer.yml reference
The file that bounds the agent: what it may touch, what always waits for a human, what it must never do.
- Report a vulnerability
Responsible disclosure goes to our security address, not to a public issue. We answer.
Ship more. Maintain less.
We expect software to be written faster than any team can review it. Bring your repos, your boxes and your keys. We bring the org that keeps up.