Security
What happens to your code, your token, and your report. Only claims the code enforces.
§ 1 Transport and storage
All traffic to validash.com and to our API endpoints is served over TLS, and HSTS is enforced at the hosting layer. Extracted code payloads are stored in Google Cloud Storage, which encrypts all objects at rest by default. Client access to the payload storage path is denied entirely; payloads are readable only by our server-side functions.
§ 2 Payload lifetime
Extracted payloads are deleted immediately after a completed audit. Payloads from abandoned or failed sessions are removed by a sweep that runs every 15 minutes. As a hard backstop, a storage lifecycle rule deletes anything under the payload path within 24 hours of creation. Your report persists; your source does not.
§ 3 Training
Payloads are never used to train any model, ours or our providers'. All model-provider usage is on business or API terms under which inputs are not used for training.
§ 4 Access tokens
If you submit a read-only GitHub personal access token for a private repository, it is encrypted with AES-256-GCM before it is written anywhere, stored with a 15-minute expiry, and deleted immediately after the repository fetch completes, whether the fetch succeeds or fails. A scheduled sweep removes any expired token documents that escape the immediate delete.
§ 5 Endpoint protection
Every callable API endpoint enforces Firebase App Check, so requests must originate from an attested instance of this application.
§ 6 Report sharing
Report share links carry a 256-bit random token generated with a cryptographically secure generator. Shared access is checked server-side, including report expiry, before any report data is returned.
§ 7 Subprocessors
Everyone who touches your data is named. The current list, roles, locations, and training commitments are at /subprocessors, updated before any provider is added or replaced.
§ 8 Reporting a security issue
Found something? Email support@validash.com with "SECURITY" in the subject. We read it.