Security

Permissions & data handling

Repository permissions

Shimpilot only ever accesses the specific repositories you select when installing its GitHub App. There is no way to grant it access to your entire account or every repository in an organization implicitly.

GitHub App access

Access is scoped through a GitHub App installation, using short-lived installation access tokens for each operation. Shimpilot never requests or stores a full-account personal access token or user OAuth token for repository actions.

Source-code handling

A repository is cloned with a shallow, single-commit clone into an ephemeral workspace for the duration of one scan or migration attempt. The workspace is unconditionally removed afterward, including when the scan fails — nothing from your repository is retained on disk beyond that window.

Migration patches are generated from the specific finding text and the file being changed — never your full repository — and the AI provider never receives credentials, environment variables, or unrelated files.

Secrets and environment variables

API keys, GitHub tokens, and other credentials are never written to application logs, pull request descriptions, or AI prompts. Error messages surfaced to the dashboard are redacted before being stored or displayed.

← Reference Back to start