Security
What happens to your code, your token, and your report. Only claims the code enforces.
§ 1 Transport and storage
All traffic to validash.com and to our API endpoints is served over TLS, and HSTS is enforced at the hosting layer. Extracted code payloads are stored in Google Cloud Storage, which Google encrypts at rest by default. Client access to the payload storage path is denied entirely; payloads are readable only by our server-side functions.
§ 2 Payload lifetime
Extracted payloads are deleted immediately after a completed audit. Payloads from abandoned or failed sessions are deleted by a scheduled sweep, and no payload survives more than 24 hours from the moment it was created, whatever state its session ended in. A storage lifecycle rule on the payload path sits behind that as a second line of defence, though Cloud Storage runs lifecycle actions asynchronously and does not commit to a deadline for them, so the 24-hour bound rests on our own sweep rather than on that rule. What persists is your report, including the short fragments each finding quotes as the evidence for it. The extracted payload does not.
§ 3 Training
We never use payloads to train a model. All model-provider usage is on business or API terms under which inputs are not used for training, which is the provider's own commitment rather than ours; every provider is named at /subprocessors.
§ 4 Access tokens
If you submit a read-only GitHub personal access token for a private repository, it is encrypted with AES-256-GCM before it is written anywhere, stored with a 15-minute expiry, and deleted immediately after the repository fetch completes, whether the fetch succeeds or fails. A scheduled sweep removes any expired token documents that escape the immediate delete.
§ 5 Endpoint protection
Every callable API endpoint enforces Firebase App Check: a request that does not carry a valid attestation token for this application is rejected.
§ 6 Report sharing
Report share links carry a 256-bit random token generated with a cryptographically secure generator. Shared access is checked server-side, including report expiry, before any report data is returned.
§ 7 Subprocessors
Everyone who touches your data is named. The current list, roles, locations, and training commitments are at /subprocessors, updated before any provider is added or replaced.
§ 8 Reporting a security issue
Found something? Email support@validash.com with "SECURITY" in the subject. We read it.