Security and your code
Private repositories never reach our server
When you sign in with GitHub, denoise reads your private repositories in your browser: the page asks api.github.com for the files with your own access token and parses and draws them in a background thread of the page. Their code, file names and paths are never sent to denoise's server, never cached there, and never logged. Nothing is stored in your browser either: what was read lives in the page's memory and is gone when you close it.
What our server does
- Public repositories are read from GitHub and drawn on our server, and the drawings are cached by commit so the next visitor gets them quickly. The server only ever reads public repositories, and checks that a repository is public before listing, comparing or searching it.
- Sign-in goes through the denoise GitHub App. The server exchanges GitHub's one-time code for tokens and keeps your session in a cookie encrypted with AES-GCM, readable by no script on the page (HttpOnly), sent to the sign-in endpoints only, and never to other sites (SameSite=Strict). The page receives an access token that expires within hours and keeps it in memory only. Signing out revokes it.
What the GitHub App may do
Read-only access to the contents, metadata and pull requests of the repositories you choose when you install it, and nothing else: it cannot write, comment or change settings. You can change the repositories or remove the app at any time in your GitHub settings under Applications.
The page itself
A strict Content Security Policy lets the page run only its own scripts and talk only to denoise and api.github.com. Analyzed code is escaped before it is shown, and every drawing is checked for unexpected markup in our tests.
Without a browser
The denoise-data command runs the same engine on your machine, on a local checkout or on GitHub with your own token, and prints the result as JSON. Nothing goes to denoise's server at all.