Privacy Policy

At a glance

• The Shadscan CLI runs locally. It does not send your source code or scan results to us unless you explicitly use a hosted Shadscan endpoint.
• The public web scanner accepts public GitHub repositories only.
• Source material used for a hosted scan is extracted into temporary storage and deleted after the scan completes or fails.
• We may cache a successful report for the same public repository commit to avoid repeating identical work. Source files and archives are not cached.
• Large eligible scans may run through a durable queue. Queue and job records contain immutable public repository coordinates and operational metadata, not source files.
• Shadscan uses deterministic rules rather than AI, and we do not use submitted source or reports to train AI models.
• We use Vercel Web Analytics for aggregate page-view statistics. We do not add advertising trackers or sell personal information.

Information we process

Website and request information

Our hosting provider may process standard request information such as your IP address, browser and device information, requested URL, timestamps, response status, and diagnostic data. We use this information to deliver and secure the service and investigate failures or abuse.

We enable Vercel Web Analytics, which records page views and may process the timestamp, page path, referrer, filtered query parameters, coarse location, browser, operating system, device type, and analytics script version. Vercel derives a short-lived visitor hash from the incoming request for aggregate statistics and discards the visitor session after 24 hours. We do not send repository input or scan reports as custom analytics events.

Public repository scans

When you submit a repository through the web scanner, we process the public GitHub owner and repository name. Shadscan asks GitHub for repository metadata and bounded source blobs or an archive, scans a temporary copy, and returns the report to your browser.

Runtime logs for web scans may include the public repository name, a random request identifier, scan outcome, duration, resolved revision, score, actionable count, and Shadscan engine and ruleset versions. Failed scans are logged without the submitted repository name, but may include bounded byte counts, the failed processing stage, internal status codes, and GitHub's request identifier.

When report caching is enabled, Neon may store a successful report, the immutable commit, selected project path, scanner versions, and a digest of the repository identifier. The cache does not contain source files or archives. Failed and incomplete scans are not cached.

Large eligible scans may be queued. Vercel Queues may temporarily store the public repository name, immutable commit, selected project path, opaque job identifier, scanner category, and a cache key. Neon stores job state, timestamps, attempts, those immutable identifiers in hashed or public form, and only a hash of the browser's bearer token. Neither provider receives source files in the queue or job record.

Hosted API scans

Authenticated API users may request a public GitHub scan or submit a compressed project snapshot. A snapshot can contain source code and other files selected by the user. Do not submit secrets, credentials, private keys, unnecessary personal information, or files you are not authorized to process.

API keys are compared using cryptographic hashes. Rate limits use the API key identifier rather than storing the presented secret as the rate-limit key.

Rate-limit information

The web scanner reads the network address supplied by our trusted hosting layer and immediately transforms it into a keyed HMAC value. The raw address is not stored in the application's rate-limit table. We separately transform the normalized public repository identifier into a SHA-256 digest to prevent repeated scans of the same repository. Neon Postgres stores those digests with counters and window timestamps configured around ten-minute and twenty-four-hour limits.

Local preferences

Shadscan stores your light, dark, or system theme choice under the local-storage key theme. This preference stays in your browser and can be removed through your browser settings.

Communications

If you email us, we process your email address and the contents of your message so we can respond and maintain appropriate business records.

How we use information

We process information to:

• provide repository scans and return deterministic reports;
• authenticate API requests and enforce usage limits;
• protect Shadscan, its users, and third parties from abuse;
• diagnose failures and maintain service reliability;
• respond to support, legal, and business messages; and
• comply with law and enforce our terms.

Where applicable law requires a legal basis, we rely on performance of a contract or steps you request before a contract, our legitimate interests in operating and securing Shadscan, compliance with legal obligations, and consent where we specifically request it.

Service providers and disclosures

We use a limited set of providers to operate Shadscan:

• Vercel for website hosting, delivery, runtime infrastructure, logs, and aggregate Web Analytics, and durable processing of eligible queued scans;
• Neon for distributed rate-limit, report-cache, and queued-job records;
• GitHub as the source of public repository metadata and archives.

We may also disclose information when required by law, to protect rights and safety, to professional advisers under confidentiality, or as part of a business transfer. We do not sell personal information or share it for cross-context behavioral advertising.

Retention

• Temporary repository archives and snapshots are deleted after the scan completes or fails.
• Application rate-limit records contain hashed identifiers, are marked to expire after two configured windows, and are pruned in bounded batches, subject to provider backup and operational practices.
• Successful cached reports expire after the configured cache period, which is no more than 30 days, subject to provider backup and operational practices. Source files and archives are not included in those records.
• Queue messages, queued-job records, and hashed polling access expire after the configured job period, which is no more than seven days, subject to provider backup and operational practices.
• Runtime logs are retained according to our hosting configuration for as long as reasonably necessary for security, diagnosis, and reliable operation.
• Vercel discards the Web Analytics visitor session after 24 hours; aggregate page-view statistics are retained according to our hosting plan and configuration.
• Communications are retained while needed to answer your request and maintain appropriate business records.

Cookies and similar storage

Shadscan does not set advertising cookies. Vercel Web Analytics does not use third-party cookies; it uses a request-derived visitor hash for aggregate page views. The theme preference described above uses local storage. Providers and websites you visit through external links operate under their own cookie and privacy policies.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal information, and to object to certain processing. You may also withdraw consent where processing relies on consent and lodge a complaint with your local data-protection authority.

We do not use personal information for decisions that produce legal or similarly significant effects. A Shadscan score evaluates repository source patterns, not a person.

Some identifiers are deliberately pseudonymized or short-lived, which may limit our ability to connect them to you. We may ask for enough information to verify and locate a record before responding to a request.

International processing and security

Our providers may process information in countries other than your own. Where required, transfers are handled using recognized legal safeguards. We use reasonable technical and organizational measures designed to protect information, but no online service can guarantee absolute security.

Children

Shadscan is a developer tool and is not directed to children under 16. We do not knowingly collect personal information from children through the service.

Changes to this policy

We may update this policy as Shadscan changes. We will post the current version here and change the date above. Material changes may also be announced on this website.

Contact

For privacy questions or requests, email orc@orcdev.com. Do not send repository secrets or source code with your request.