A reviewer you can let near your code.

• TLS everywhere

  All traffic to Warpway uses TLS. Browsers are told to use HTTPS only (HSTS for two years, including subdomains).

• Encryption at rest

  Data is stored in Neon Postgres, which encrypts it at rest. Slack bot tokens are additionally encrypted by Warpway with AES-256-GCM and bound to their installation, and GitHub sign-in tokens are stored encrypted.

• Short-lived GitHub tokens

  Warpway acts on repositories with GitHub App installation tokens that expire within an hour. They are held in memory only and never written to the database.

• Secrets stay out of code

  API keys, signing secrets and encryption keys live in encrypted environment variables. Encryption keys can be rotated without losing access to existing data.

• Opaque sessions

  Your session cookie holds a random token. The database stores only its SHA-256 hash, so a database copy cannot be used to sign in.

• Minimal GitHub permissions

  Metadata, Contents and Issues are read-only (Issues lets Warpway receive pull request comments), and organization Members read access verifies membership; Pull requests and Checks are write so Warpway can comment, request reviewers and publish its check. Actions write is never part of the Warpway app: runtime verification, if you turn it on, uses the separate Warpway Runtime app, which asks for nothing else. Warpway cannot push code or merge.

• Minimal Slack scopes

  chat:write, im:write, im:history and users:read. users:read.email is requested only if an admin enables email-based identity matching, and usergroups:read only if questions are routed to Slack user groups. No channel history scopes.

• Tenant isolation

  Every query for customer data is scoped to your organization, derived from your verified membership. Identifiers sent by a browser are checked for ownership before they are used.

• Roles

  Members view reviews and answer tasks. Admins configure repositories, lenses, Slack, routing and policy. Only Owners manage billing, retention, deletion, organization locks, high trust levels and auto-approval.

• Signed webhooks

  GitHub deliveries are verified with HMAC SHA-256, Slack requests with Slack’s signing secret and a five-minute timestamp window, and Stripe events with Stripe signatures, all against the raw body before anything is parsed.

• Replay and duplicate protection

  Each GitHub delivery, Slack event and Stripe event ID is recorded once; a repeat is acknowledged and ignored. Background jobs carry idempotency keys, so a retried job cannot act twice.

• OAuth state protection

  Sign-in, installation and Slack connection flows use single-use, short-lived state bound to your browser, which blocks cross-site request forgery.

• Rate limiting

  Public endpoints are rate limited to blunt abuse.

• No stale results

  Before any visible update, Warpway confirms the review is still the current one for the pull request’s head commit. An older review cannot overwrite a newer one.

• Prompt-injection defenses

  Files, PR text, comments, tickets and Slack messages reach the model as clearly delimited untrusted data. The model is told to treat them only as data and to flag any attempt to instruct the reviewer as a security observation. Such text cannot change Warpway’s instructions or the tools a lens may use, and it never decides a result: policy is evaluated by code.

• Fixed, read-only tools

  Lens tools read one repository at one commit and come from an allowlist in your configuration. No tool runs shell commands, and model output cannot widen what a tool may access.

• Policy from the base branch

  The configuration that reviews a pull request is read from its base branch, so a pull request cannot relax the rules it is judged by.

• Fail closed

  A failed model call, tool, repository fetch or verification run leaves the affected lens Incomplete. Nothing turns green by default.

• Deterministic decisions

  Whether policy is satisfied, and whether a pull request may be auto-approved, is computed by code from stored results. A model never makes either decision.

• No source code in logs

  Logs record identifiers, counts, durations and statuses. A redacting logger drops fields that carry code, diffs, prompts and answers, masks known secret formats such as tokens and keys, and truncates long text.

• Slack minimization

  Slack messages carry a plain-language question and a link to the details, never diffs.

• Retention and deletion

  Pull request snapshots, code excerpts and task conversations are deleted after your retention period: 180 days by default, adjustable by an Owner from 7 to 3,650 days. Webhook payloads are deleted after 7 days. An Owner can delete all of the organization’s data at any time.

• Audit log

  Routing decisions, answers, configuration and trust changes, admin actions and every automatic approval are recorded with who, what and when.

• No training on your code

  Warpway does not train models on customer code. OpenAI, our model provider, does not train on data sent through its API unless a customer opts in, which Warpway has not.

Services you connect

• GitHub. Where your code lives and where Warpway posts its check, summary comment and reviewer requests.
• Slack. Where Warpway asks questions in direct messages and receives answers, if you connect it.

We update this list when our subprocessors change.