The engine runs on your runner or your machine. Your source never transits our servers, never touches our storage, never trains a model. The cloud only ever sees what you choose to send it: findings reports, not repositories.
The Action runs the engine on your GitHub runner; the CLI runs on your machine. Findings post back to your PR. Your source code does not transit our servers — there is no cloud analysis surface receiving it.
Nothing is sent to us unless you choose it. With --upload or --share, the CLI sends a findings report (severities, messages, the flagged lines) to your own dashboard — not your repository. Reports are never used to train models.
TLS in transit. Data is encrypted at rest via our hosting and database providers (Vercel, Supabase). We do not yet operate our own KMS or rotate provider-side keys ourselves.
Production is a handful of managed providers — Vercel, Supabase, Stripe — with row-level security on every database table and production access limited to the founding team. No fleet of services to misconfigure.
No card data processed
Stripe handles all payment surfaces
Email-based DSR
See compliance page for full posture
Fig 03 · Stamps print on scroll-into-view
Email security@codetitan.dev. We read every email but cannot yet guarantee response times during pre-launch. Coordinated disclosure preferred, with credit unless you prefer anonymity.
Plain email is fine while we're pre-launch. We'll publish a PGP public key here once one exists for security@codetitan.dev.
No PGP fingerprint to publish yet · do not trust any key claiming to be ours until linked from this page.
Apache-2.0 — read the source, run it air-gapped, watch the network tab.
