Reference
Privacy and security
A security tool should be the safest thing on your machine. Here's exactly what happens to your data.
At a glance#
| Data | Where it goes |
|---|---|
| Your source code | Stays on your computer. GitHub repos are downloaded to a temp folder and deleted after the scan. |
| Findings and reports | Stay on your computer. |
| GitHub token, AI keys, database passwords | Encrypted in your OS keychain. Never sent to VIfix. |
| AI fix requests | Sent from your computer straight to Anthropic or OpenAI, with secrets redacted. See AI fixes. |
| Your account | Email, plan and usage counts, stored on getvifix.com to enforce plan limits. |
Credentials#
- Tokens and passwords are encrypted with your operating system's keychain.
- The app's interface never receives your GitHub token or database passwords. It only knows your GitHub username and connection names.
- Passwords and connection strings are removed from every error message.
How the app is hardened#
- The interface runs sandboxed with no direct file or network access. All privileged work happens in a separate process that validates every request.
- Sign-in uses PKCE and a one-time code. Unsolicited
vifix://links are ignored. - Releases are code-signed, and macOS builds are notarized by Apple.
Read more on the Security page.