Security and data handling
Access, execution and retention.
Understand what your teammate can access, what it records and what remains after a task. Review these controls against your team’s requirements before connecting production systems.
Project-scoped access
Tasks use the projects, repository permissions and target access configured for your account. A connected repository does not grant permission to modify unrelated code. Review write permissions before enabling fix proposals.
Sandbox execution
Connected code workflows execute in an isolated sandbox. Browser checks use managed Chromium sessions. Access, tooling and environment configuration determine what a task can check.
Runtime cleanup
Runtime resources are released through session cleanup. A configured grace period can keep a session available for follow-up work; completion does not imply an immediate wipe of every runtime or stored artifact.
Evidence and history
Task records contain the observations and evidence collected by the selected tools. Available artifacts vary by mode. Browser recordings and newly uploaded hosted images are retained for 7 days on Free and 30 days on active paid plans.
Code-review history controls
The project setting can delete code-review conversation history after completion. It does not remove comments already posted to GitHub or another provider, or replace the separate media retention policy. Deleted history cannot be inspected later.
Credentials and connectors
Use dedicated test accounts and the smallest provider permissions your workflow needs. Add credentials through the project flow and keep CLI tokens in a secret manager. Third-party services also apply their own policies.
Discuss your security requirements.
Contact our engineers for the details relevant to your target environment, provider access and retention requirements.