A plain-language answer to the three things every security reviewer asks before approving a new tool: where your code goes, what is done with it, and what the GitHub App actually gets to see.
1 · What we read from each PR
Where does my code go?
PulseRadar reads only the targeted material needed to review a pull request: the list of file paths that changed, the unified diff hunks (the added and removed lines, not the whole file), the PR title and description, and the commit metadata GitHub sends on each webhook. Nothing else from your repository is pulled in.
What does PulseRadar analyze?
Each scan evaluates four risk categories: security (auth handlers, secret files, credentials), performance (hot paths, blocking calls), correctness (logic, null handling, type errors), and breaking changes (removed exports, signature changes, API drift). Findings are scored 1–10 and filtered for noise before anything is posted.
Where does the analysis run?
On PulseRadar’s own infrastructure, in response to GitHub webhook events. The diff is sent to OpenAI as part of a single analysis call per scan; the response is what becomes the severity-tagged PR comment. The rest of the analysis (category detection, severity scoring, noise filtering, removed-export detection) runs locally in services/ against the diff text — no third-party system receives the full picture.
2 · What we do not do
No model training on your code
PulseRadar does not fine-tune, retrain, or otherwise update any model on customer code. The diff text is sent to OpenAI for a single inference per scan and is governed by OpenAI’s standard API terms — not used for training.
No resale or aggregation
PulseRadar does not resell, bundle, anonymize-and-aggregate, or otherwise commercialize your code or PR data. There is no shared corpus across customers, and no internal analytics product built on top of customer diffs.
No third-party data sharing
Your code does not leave the analysis path. The only third party that ever sees diff content is OpenAI (for the analysis call itself). Daily digest emails are delivered through PulseRadar’s own SMTP. No code or PR content is shared with marketing tools, analytics platforms, or any other external service.
3 · Data retention
Data retention
Diff snippets are held in memory only as long as needed to post findings and surface them on /dashboard. Raw webhook payloads are not archived. Findings records persist in the findings database table — severity, file path, line, and description — so the dashboard and daily digest keep working. Those records are deleted automatically when a repo is disconnected (the repos row is removed and the FK cascade clears its findings).
4 · GitHub App permissions
What the GitHub App actually requests
Four scopes — the minimum PulseRadar needs to monitor your repos and post findings. No more, no less.
contents: read
Read source code to analyze diffs and flag issues in changed files.
pull_requests: write
Post severity-tagged finding comments on PRs — one grouped comment per scan.
issues: read
Read issue threads for triage context, so related findings can be linked.
members: read
Identify team members so review assignments and notifications route correctly.
See the full install flow and the same permission table on /install.