Privacy

The short version

We clone your repository into an isolated temporary environment, measure it, send a small redacted sample to a language model for assessment, save the resulting numbers, and destroy the environment. Your source code is never written to our database, and we never use it to train models.

What we ask GitHub for

We use a GitHub App, not a personal access token. That matters because it means:

• Read-only. We request read access to repository contents and metadata. We never request write access, and cannot modify, push to, or delete anything.
• You choose the repositories. During installation you can grant access to specific repositories rather than all of them. We recommend that.
• Short-lived credentials. Access is granted through installation tokens that expire within the hour. We do not hold a long-lived key to your account.
• Revocable. Uninstalling the app, or deselecting a repository, removes our ability to read it — the tokens we mint are scoped to the installation, so they stop working. If you are a member of an organisation that installed the app, note that leaving the organisation does not by itself revoke this app; an organisation owner should uninstall it or remove the repository from its access list.

What happens during a scan

1. We create a record of the analysis and start an isolated, single-use worker.
2. The worker requests a short-lived installation token and does a shallow clone of the one repository you selected onto temporary disk.
3. The repository is analysed in place: counting, classifying, and detecting frameworks.
4. A deterministic sampler selects a small number of representative files. Every sampled file is scanned for credential-shaped strings, which are replaced before it goes anywhere.
5. The measurements and redacted samples are sent for assessment. The measurements and the resulting report are saved.
6. The worker is destroyed and the cloned repository goes with it.

What we store

Permanently, in our database:

• your GitHub user id, username and avatar URL
• the names of repositories you granted access to, so we can show you a list
• derived measurements — line counts, framework names, structural counts
• the assessment and the resulting estimate
• the commit hash that was analysed

What we never retain

Your source code is never written to:

• our database, in whole or in part
• any object storage or backup
• application logs
• analytics or error reporting

GitHub access tokens are never written to logs either.

We say “not retained” rather than “never stored” because there is one place your code does briefly exist: the temporary disk of the single-use worker that clones it. That worker is destroyed at the end of the analysis and the clone goes with it. Beyond that, the sampled excerpts exist only in memory, for the duration of one analysis, and nothing on our side writes them down.

The language model

Assessment is performed by Anthropic’s Claude API. It receives the measurements and the redacted samples. Anthropic does not train its models on API inputs. We do not train any model on your code, and we have no interest in doing so.

Secret redaction

Before any sampled file leaves the worker, it is checked for common credential patterns — cloud keys, API tokens, private key blocks, connection strings with inline passwords, and environment-variable assignments that look like real secrets. Matches are replaced. Files that are obviously credential stores, such as .env, are never sampled at all.

Redaction is best-effort pattern matching, and we would rather say so than imply a guarantee. It is a safety net, not a reason to leave secrets committed. If you have credentials in your repository history, rotate them — that is worth doing regardless of us.

Sharing is off by default

Results are private. Nothing is published unless you explicitly choose to share it.

A shared page always shows the estimated value, the analysis date and a few high-level engineering metrics — the number of capabilities we found, the number of integrations, and an architecture grade.

Three further things are each their own separate choice:

• The project name. The repository’s name on its own, without its owner.
• The repository. Which repository this is, and who owns it. Off by default for private repositories.
• The commit. The short hash that was analysed. Off by default.

Nothing else is ever published: no file names, no paths, no architecture detail beyond the grade, no indication of whether the repository is private, and no part of the paid report. Each choice applies to the page, its title, its link preview and its social card alike — a field you have not ticked does not reach any of them.

One number does appear without sharing: the undervalued.dev homepage shows the most recent valuation as a bare figure — no project name, no repository, no link, no date, and nothing else that could connect it to you or your code. It is replaced the next time anyone completes a valuation.

Sharing is what puts anything identifying on that spot: while your result is the newest, the homepage shows the same name and link your share page shows, and nothing more.

You can make a shared result private again at any time. That takes effect immediately — the shared page stops resolving, and the homepage strips back to the bare figure.

Deleting your data

Removing the GitHub App revokes our access immediately. To have your account and analyses deleted entirely, email us and we will remove them.

Payments

Payments are handled by Stripe. We never see or store your card details.