How Pallos handles your code.

Public scans

Paste a public GitHub repository URL without signing in or installing a GitHub app. Pallos fetches source at one commit and evaluates selected supported files. It does not execute the project or write to GitHub. The report stays in your browser session; a copied scan link prefills the repository URL, not the report.

Connected repositories

For repositories selected through the GitHub App, Pallos requests read-only contents and metadata. Short-lived installation tokens are generated when needed; a permanent GitHub access token is not stored. Connected scans and push webhooks can run new scans. Pallos cannot modify, push, merge, or deploy code. You can disconnect in Pallos and revoke the installation in GitHub.

Storage and retention

Connected scan records and findings are stored with your account; complete source files are not stored as scan records. Evidence excerpts may be retained with findings, with detected credential material redacted. Public-scan feedback is optional; it is stored with the scan identifier and finding identifier when supplied. Contact information is optional and only used for follow-up. Disconnecting GitHub removes associated Pallos scan data; account deletion removes associated product data.

Limits and contact

A static pass is not proof that an application is secure. Pallos cannot verify every authorization path, deployed setting, third-party service, or runtime exploitability. Public scans may cap the number of files reviewed, and the report identifies what was not tested.

Report a security or privacy concern to pallosagent@gmail.com. Do not send passwords or API keys.