GitHub permissions & security

The app has no backend for GitHub data: your browser calls api.github.com directly, and GitHub credentials are sent there and nowhere else. A personal access token never leaves your browser except to GitHub, and the app never logs it.

If you sign in and connect GitHub, your sign-in session token (not a GitHub credential) is sent to our token service at github.kanzen.sh, which mints a short-lived GitHub token and returns it to your browser. That token lives only in the page's memory and is likewise sent only to api.github.com.

There are two ways to grant access, and both are minimal:

• Connect GitHub installs our GitHub App on the repositories you pick. Its permissions are read-only: repository contents and pull requests (plus the metadata read GitHub implies). Tokens minted through it are scoped to what you can access and what the installation covers, expire after about eight hours, and your browser holds them in memory only. The service's own copy is stored encrypted (see below).
• A personal access token is the fallback. You create a fine-grained PAT yourself, and the app prefills the form with the least it needs (Contents: read, Pull requests: write). Write is there only so the app can post review comments you write, and a read-only token works for everything else. You choose which repositories the token covers on GitHub's own form, and the token stays in your browser.

Reviewing is read-only. The single write the app ever performs is creating a PR review comment when you submit one. It is posted directly to GitHub with your credential and attributed to you, and one thing is added to your text: a small “View this thread in Markdown Review” footer line, once per thread, visible on GitHub. The app never edits files, merges, or approves anything.

• On this app's servers: nothing. No database, no copies of your repositories or pull requests, no tokens.
• Your GitHub connection, if you connect: the token service stores your GitHub account identity and encrypted OAuth tokens, the minimum that “connect once” needs, kept server-readable only. It never stores repository content, and revoking the app's access on GitHub makes the stored tokens dead.
• In your browser: your personal access token, if you saved one (the 🗑 button removes it), and the “viewed” state of review sections. Viewed marks are content fingerprints (hashes), not readable text, and expire after 30 days.
• In memory only: the PR content on screen and any connected-account token, both gone when you close the tab.
• Account: signing in uses Clerk, the same account as kanzen.sh. The app itself keeps no account data.

Pull-request markdown is third-party input, so the renderer never executes it: raw HTML embedded in markdown is not rendered at all.