GitHub boundaries
Repository access is granted through the GitHub App and scoped to selected repositories.
- Short-lived installation tokens
- No browser access to GitHub secrets
- No automatic merge
Execution boundary
Scanner and fix work is designed for temporary, bounded execution. Repository code is treated as hostile input.
- No package manager execution
- No repository tests or builds
- Workspace cleanup after execution
Verified remediation
Verification is a product state, not a marketing badge.
- Original scanner completes
- Original finding disappears
- Regression gates check Critical and High findings
Onboarding posture
Self-serve repository onboarding remains gated until the production execution environment is fully validated.
- Access by review
- No unsupported infrastructure claims
- Human decision before shipping