Security
Reporting a vulnerability
Email stephanie@klaussy.com with "security" in the subject line. Tell us what you found, how to reproduce it, and what you think the impact is.
Please don't open a public GitHub issue or share details publicly until we've had a chance to fix it.
What we commit to
- We'll acknowledge your report.
- We'll keep you updated as we look into it and fix it.
- We'll credit you for the find if you want us to.
How klaussy review protects your code
- Each review runs in its own single-use container with no public IP address.
- Outbound traffic can only go through a proxy with an allowlist.
- DNS requests go through a DNS firewall.
- Your AI credential is held outside the agent by a proxy. The agent only ever sees a placeholder.
- Stored credentials are encrypted with AWS KMS.
- The GitHub token for each review is scoped to one repository.
- Only account owners and organization admins can change settings.
- Reviews are posted as comments, never as approvals.
For what we store and how long we keep it, see the privacy policy.