Review security

How Graphide review handles your repositories and pull requests.

What it can access

Graphide review works through the Graphide Review GitHub App, on the repositories you grant it on GitHub. GitHub shows the App’s permissions when you install it.

• Reading. A review reads the whole repository at the pull request, not only the diff, and the pull request’s title, description and author.
• Writing. On the pull request it creates and updates a check, posts comments and line comments, edits and replies to its own comments, adds reactions, resolves its own review threads and marks its own earlier comments outdated. With a repository’s comments setting off, it posts no comments there.
• Never. It pushes no commits, creates no branches, changes no files and never approves or rejects a pull request. A suggested fix is a suggestion block that a person applies.

By default, commands in comments (@graphide-review review, ignore, known) are taken only from the pull request’s author and the repository’s owners, members and collaborators.

Where it runs

• The review service runs on a private Azure VM in West US, with no public address and no SSH, reachable only from Graphide’s API.
• Each review runs in a container of its own on Azure Container Instances, in the United States, which is deleted when the review ends. A review is stopped after 2 hours at most, and any container left over is found and deleted.
• Your tests, where the live environment beta is on, run on the review service’s VM: The live environment (beta).

Isolation

• The review’s container holds a short-lived token for that review, the read-only GitHub token below, and an Azure identity that can only pull Graphide’s container image. It holds no GitHub write token and no model provider key.
• It clones the repository with a token that can only read that repository. The clone is deleted when the review ends.
• It runs as a user without root.
• The model reads the code only through read-only tools: read a file, search, list files and see the diff. It cannot use web search or web fetch. Graphide’s review service, not the model, posts the review.
• A pull request’s text is given to the model as data, with instructions that it is not instructions to the model.

The live environment (beta)

Running your old and your new code to prove a breakage is a beta. It is off unless we turn it on for your repository. When it is on:

• Where. Your tests run on the review service’s own VM (above), not in the review’s container.
• Checkout. The VM fetches the pull request’s commits through the GitHub App and checks them out in a folder of their own, which is deleted when the run ends.
• Jail. Each command runs in a bubblewrap jail, without root on the VM, with its own network, processes and files. What a command changes is thrown away when it ends.
• Network. Only the step that installs dependencies has a network. It reaches public addresses on ports 80 and 443 only, through a proxy, and never the VM itself, a private network or Azure’s metadata service. The tests run with no outside network.
• Caches. Each repository’s downloaded dependencies stay on the VM’s disk, to make the next run faster. They are pruned to a size limit, and dropped once the repository is no longer connected to Graphide.

Secrets

• The review service reads its keys (the GitHub App’s private key, the webhook secret and the model provider key) from Azure Key Vault with the VM’s own identity, into a file only root can read.
• Every webhook is checked against GitHub’s HMAC-SHA256 signature by Graphide’s API, and again by the review service. The review service also refuses every request but its health checks unless it carries a secret only Graphide’s API holds.
• A review never receives your GitHub Actions secrets.

What we store and for how long

What	Kept
Each review: findings with file paths, lines, text, suggested code and the evidence behind them; the pull request’s title, description and author	While the GitHub App is installed on the repository. After an uninstall, we delete them by hand within 30 days, or at once if you ask
Records of each review’s progress on a pull request: queued, posted, skipped or failed	90 days
GitHub’s webhook deliveries	Deleted 14 days after they arrive, once handled

Graphide also keeps each repository’s graph (its files, symbols, how they connect, and short excerpts of code), built from a read-only clone, in its own graph service. Turning a repository’s reviews off stops new reviews and keeps its reviews and its graph.

Who can see it

• Reviews of public repositories can be read by anyone with the link to the review’s page on graphide.com.
• A review of a private repository can be read by the Graphide account the App’s installation is linked to, and by Graphide accounts whose GitHub user can access the repository.
• Graphide staff can open a stored review in Graphide’s staff console. That needs a permission of its own, and each opening is written to an audit log.
• Before a new version of the reviewer reaches you, we may try it on your recent pull requests. A trial reads from GitHub only, posts nothing, and its results are seen only by Graphide staff.

Deletion

• Each review’s container and its clone are deleted when the review ends.
• After you uninstall the GitHub App, or remove a repository from it, we delete that repository’s reviews and graph by hand within 30 days, or at once if you ask.
• How to have a repository’s reviews deleted: Data, retention and deletion.

Third parties

• Anthropic receives the pull request, the code the model reads, and Graphide’s instructions, to write the review. Only two models are allowed: claude-opus-5-5 and claude-sonnet-5-5.
• Microsoft Azure runs the review service and the review containers.
• GitHub is where the review is read from and posted to.

The hosted MCP server

Coding agents reach Graphide review at https://mcp.graphide.com.

• Sign-in is OAuth with PKCE (S256). An agent registers itself as a public client, so there is no client secret or token to paste.
• Tokens: an access token lasts 1 hour. A refresh token lasts 90 days, is replaced each time it is used, and is stored only as a hash.
• Every request checks that the agent’s sign-in is still live, so signing an agent out under Connected agents refuses its next request.
• Scope: a sign-in grants the scope setup: your account’s review setup, settings and results.