StackWatcher

Security

Last updated 10 November 2026

StackWatcher checks your code repositories and domains for security problems, so it needs some access to them. This page explains how that access is limited, where your data lives and how it is protected. It is written for MSPs and their customers who need to answer “is this safe to connect?”.

GitHub access is read-only and short-lived

  • You choose the repositories. Your GitHub organisation installs the StackWatcher GitHub App and picks which repositories it can see, either all of them or a list. You can change that list or uninstall the app at any time in your GitHub settings, and access stops straight away.
  • Read-only. Every token we ask GitHub for is limited to reading repository contents and metadata. It cannot push code, open pull requests, change settings or see anything outside the repositories you chose.
  • Tokens last one hour and are never stored. When a scan runs we ask GitHub for a new installation token, which GitHub expires after one hour. It is held only in the server’s memory while it is valid, never in our database.
  • Connecting is protected. A connect link works once, expires after 7 days and can only be made by an admin. When it is used we check with GitHub that the installation was just made by the person who owns the GitHub account, so someone else’s installation can’t be attached to your organisation.
  • Personal sign-in tokens. If you sign in with GitHub to scan your own repositories, the token is read-only, stored encrypted, and expires after at most 8 hours. We deliberately don’t keep GitHub’s refresh token.

Your code

A scan downloads the repository, checks it in memory and then discards it. We keep the results: the issues found, file paths and short excerpts around each issue (never for leaked secrets). If an AI review runs, a selection of the most security-relevant files is sent to Anthropic’s Claude API; committed .env files are never sent. Anthropic doesn’t use API data to train its models, and nor do we.

Where your data is kept

The application servers and the database holding your account, organisations, projects and scan results are hosted in the EU/UK, on Vercel and Neon. Some services we rely on process data elsewhere, mainly in the United States: GitHub, Anthropic (AI reviews), Resend (email) and Stripe (billing). The full list, and what each one receives, is in our Privacy Policy.

Encryption

  • All connections to StackWatcher use HTTPS.
  • Stored GitHub sign-in tokens and our session cookies are encrypted with AES-256-GCM. The session cookie holds only your user ID, and is HTTP-only so page scripts can’t read it.
  • Passwords are never stored, only a salted scrypt hash of them.
  • Our database and hosting providers encrypt data at rest.

Who can see what

Every customer is its own organisation. People only see the organisations they belong to, with one of four roles: viewer (read reports), member (add projects and run scans), admin (manage people and connect GitHub) and owner. An MSP can open the customer organisations it manages, and each time it does that is recorded in the customer’s audit log.

Audit log

Each organisation has an audit log recording who did what and when: connecting and disconnecting GitHub, making connect links, inviting, adding and removing people, changing roles, creating and renaming organisations, branding changes, and an MSP opening the organisation from above. Entries keep the names involved, so they still make sense after a person or organisation is deleted. Admins can search and filter it in the app.

Domain checks

Email, DNS and website checks only use public information: DNS records and the response your website gives any visitor. To check DNSSEC we ask Cloudflare’s public DNS resolver about the domain name. Nothing is installed on your systems.

Reporting a vulnerability

If you think you have found a security problem in StackWatcher, email contact@ahyslop.co.uk with the details and how to reproduce it. We’ll reply within 3 working days and keep you updated until it’s fixed. Please don’t access other people’s data, disrupt the service or make the problem public until we’ve had a chance to fix it. We won’t take action against good-faith research that follows these rules. Our contact details are also published in security.txt.

Accreditation

We are working towards UK Cyber Essentials certification. We’ll list certifications here once they are awarded.