Security at bugstack

Three autonomy levels per repository: "Draft fixes for me", "Open PRs, I merge", and "Fix & merge for me". New accounts start at the review level: bugstack opens pull requests and you merge them.

Sensitive actions always wait for a human. Secret rotation, infrastructure changes, and deploy rollbacks need your approval at every level.

Audit log: Every decision lands on a tamper-evident audit log.

Undo: Undoing a change opens a revert pull request.

A crash report is text an outsider can influence. If someone can make your app throw an error containing words they chose, those words reach an AI model. This is called prompt injection, and any AI tool that reads untrusted text has to be designed for it. This is how bugstack is built against it.

The ingest key is a secret, kept on your server. bugstack has no public key for browsers and does not capture browser errors. An outsider cannot post events to your project without your key.

Error text is marked as data. Error messages, stack traces and log excerpts are wrapped in markers before they reach the model, and the model is told to treat them as evidence only. This lowers the risk. It is not a guarantee, and we do not rely on it alone.

The fixer cannot run anything. Writing a crash fix is a single model call that returns proposed edits. The model has no shell, cannot install a package, and cannot make a network request. bugstack’s own code applies the edits and opens the pull request.

The model does not choose your packages. For a dependency update, the package name comes from your manifest and the version from the registry. The model writes only the summary. Lockfiles are regenerated with install scripts switched off.

The limits that matter sit outside the model. Whether a change may merge is decided by rules in code: the guardrails above, the autonomy level you set, and the audit log. The model that wrote the change has no say in it.

What this does not cover. bugstack does not yet scan incoming error text for injection attempts. That detector is planned. And a pull request from bugstack runs your CI before you have read it, like a pull request from anyone else with write access. Keep deploy credentials out of pull-request workflows, and stay on the default level, where you do the merging, until you trust what you see.

Error data (stack traces, error messages, request context) is retained indefinitely. Duplicate errors within a 24-hour window are collapsed into a single record with an occurrence count. Deleting a project cascades to all associated error and fix data.

bugstack does not keep a copy of your codebase. What it keeps from your repository: a map of file paths, an inventory of your packages and versions, each finding with its location, and each change it proposes (the title, the explanation, the diff and the files it writes). Source files are fetched through GitHub when a scan or a fix needs them.

File tree metadata (paths and types only, no contents) is stored per project to enable scoped context building.

Request context is redacted before storage. Header values, query parameter values, and request body values are replaced with [REDACTED] — only key names are visible.

Infrastructure: PostgreSQL on Neon (AWS, US region). Application hosted on Render (Oregon). No multi-region replication.

AI providers: Fixes are written by Anthropic's Claude. One other provider is involved. bugstack keeps a searchable record of the intent behind changes, drawn from pull request descriptions and any documents you upload or connect, and it indexes that text with OpenAI's embedding model.

What we send to the model: error type, message, stack trace (first 15 lines), the primary source file, up to 10 related files (imports, 2 levels deep), type definitions, test files, and framework context. Request context values are redacted — only key names are included.

Model training: Your code is not used to train or fine-tune models. bugstack does not train models, and neither Anthropic nor OpenAI trains on data sent through its API by default. See Anthropic's privacy policy for how long it keeps API data.

At rest: Sensitive fields (GitHub access tokens, refresh tokens, project API keys) are encrypted with AES-256-GCM — authenticated encryption with random 12-byte IVs and 16-byte auth tags. Error data is stored with Neon's default storage encryption.

In transit: TLS 1.2+ enforced on all connections. TLS is terminated at Render's reverse proxy with automatic certificate provisioning. Database connections use sslmode=require.

bugstack uses GitHub OAuth for sign-in. The sign-in asks for read and write access to your repositories, which GitHub calls the repo scope. That scope is broad, so this is the limit we hold ourselves to: bugstack reads and writes only the repositories you connect.

Production infrastructure (Render, Neon, GitHub org) is single-operator — no shared credentials or team access.

SOC 2: Not currently pursued. Our infrastructure providers (Neon, Render, Anthropic) maintain their own SOC 2 certifications.

GDPR: bugstack can process EU user data — both Neon and Render offer EU regions. No formal Data Processing Agreement (DPA) is available at this time. If you have GDPR-specific requirements, contact us.

Data deletion: Deleting a project removes all associated error data, fixes, and metadata. Account deletion is available on request.

For a deep dive into exactly what data the SDK transmits, see Data and Privacy. For architecture details on the capture-to-PR pipeline, see How bugstack Works.