Understand access before granting it.

A GitHub App installation identifies the repositories you select. Short-lived installation tokens are scoped to the operation and repository. Installation tokens are not persisted in the job queue or exposed in the browser.

The integration is not entirely read-only. Creating a branch and pull request requires write permissions at the Control Plane.

• Metadata: read. Contents: read and write. Pull requests: read and write.
• The remote worker receives read-only repository access. The Control Plane holds the scoped write token used for publication.
• Administration, Actions, Issues, organization and repository-secret permissions are not required by this integration.

The execution worker reads the selected checkout to run scanners. The Control Plane reads original file bytes to validate and publish a patch. Authorized organization users can view retained findings and evidence through tenant-scoped queries.

• Repository content is treated as untrusted. Package managers, hooks, builds, tests and application executables are not run.
• These technical controls are not a claim that no operator or provider can ever access stored data. Operator access and contractual responsibilities must be agreed for a customer pilot.

Temporary source checkouts are separate from retained findings, evidence snippets, patch diffs, scan reports and audit records. Workspace cleanup is recorded; a temporary checkout does not mean every copy of source-derived data is immediately deleted.

• Retention and cleanup mechanisms exist. No blanket code-retention duration is promised here.
• The customer deployment, access policy, retention, backup handling and deletion process must be agreed before connecting customer code.

When optional AI enrichment is enabled, the configured Mistral provider receives bounded finding context: rule, severity, location, description, redacted evidence and remediation information. Paths or snippets may still contain sensitive project information.

• AI enrichment adds explanations. It does not change the scanner finding, severity or score, and does not establish that a fix is correct.
• It is not a whole-repository upload. Provider processing terms, retention and region still need review for the chosen deployment.

Change the selected repositories, suspend or uninstall the Neolyt GitHub App in GitHub settings to stop future access. Revocation does not itself erase findings and reports already stored.

• For data-handling or deletion questions, use contact@neolyt.fr without sending credentials or source code.
• A deletion request needs to cover findings, evidence, operational records and any applicable backups, not only temporary workspaces.

The workflow has been tested locally using a private QA repository and real unmerged GitHub PRs. A worker image was qualified locally on 7 September 2026. The hosted AWS/Fargate customer pilot has not been validated or opened.

• No certification, contractual geographic guarantee or customer-production readiness is asserted.
• Verified Fixed covers the exact proposed commit and completed scanner policy, not functional correctness, a merge or a deployment.