What happens to the code you paste

What happens to code you submit

Your submission is held in memory for the duration of the request that processes it. It is sent to Anthropic's API to be analysed, and it is discarded when the request ends.

It is never written to a database, an object store, a disk, or a log line. There is no storage layer for source code in this product — not one with a short retention policy, but none at all. That is a deliberate architectural choice: data you never store cannot leak, cannot be subpoenaed from you, and cannot be exposed by a future bug.

Secret redaction happens before analysis

Before your code reaches any model, it passes through a redaction pass that detects and replaces common credential formats — AWS keys, GitHub and Slack tokens, Stripe and other provider keys, private key blocks, JWTs, database connection strings, and assignments to variables named like passwords or secrets.

Redaction is intentionally aggressive. It will sometimes blank something that was not a real secret. We would rather lose a finding than forward a live credential to a third party.

Not used for training

Submissions are processed through the Anthropic API under commercial terms that keep customer inputs out of model training. We do not use your code to train anything ourselves, and we do not share it with anyone else.

What we do retain

If you ask us to contact you about a full audit, we keep what you gave us for that purpose: your email address, any note you wrote, the run reference, the detected language, and the titles of the findings. That is the entire record.

The finding titles are short descriptions such as "User-supplied ID used without an ownership check". They do not contain your source code, and the evidence snippets shown in the result are not included.

If you do not submit the contact form, we retain nothing that identifies you beyond ordinary, short-lived server request logs.

What we never retain

Your source code. The evidence snippets quoted in your results. Any secret that the redaction pass caught.

Limits, and why they exist

The free tier accepts a single file of up to 400 lines or 20KB, runs one security pass, and returns at most 3 findings.

These caps are not an upsell mechanic. An unbounded automated audit is unbounded cost, and a tool that quietly loses money is a tool that gets switched off. Bounding it by construction is what lets it stay free and stay available.

Deletion

There is nothing to delete on the code side — it was never stored. If you submitted the contact form and want that record removed, email umarbinali28@gmail.com with your run reference and we will delete it.

If your policy forbids pasting source into external tools

That is a reasonable policy and we are not going to argue you out of it. The full Technical Audit is a human engagement and can be run under your terms — on a sanitised export, under NDA, or inside your own environment. Email us and describe the constraint.