how nittim handles your code
Security
How nittim handles your code, tokens, and reports.
Source snapshot — never written to disk
nittim fetches your source from GitHub over HTTPS, holds it in server memory for the run, then discards it. Never written to disk, never stored, never logged.
Each pass is bounded to 500 files and 5 MB, excluding binaries, build output, and dependencies. Full Audit can run more than one pass on a larger repo; a standard audit stops at one.
GitHub tokens — used once and discarded
A private repository needs a GitHub token. It's used once, for the call that downloads your source, then discarded. It is:
- —Not stored anywhere.
- —Not logged in any request or application log.
- —Not passed to Anthropic or any other service.
- —Not retained between requests — each audit supplies its own token.
Report storage
Reports — findings, scores, verdict, repo name — are stored in Supabase (us-east-1), retrievable later via a link or the API. Encrypted in transit (TLS 1.2+) and at rest.
Private repository reports are gated: only the requesting account or its org can retrieve them. Anyone else gets nothing back, not even confirmation the id exists.
Secrets management
Service credentials live only in Vercel environment variables — never committed to source, never shipped to the client. The pipeline runs entirely server-side.
Responsible disclosure
Found a vulnerability? Report it to security@nittim.com or through our contact form. We acknowledge a report within 48 hours and aim to patch a critical issue within 7 days. We'll keep you posted while we work on it, and we credit researchers who ask to be named once a fix ships. A paid bounty program is on the way; until it opens, security@nittim.com and the contact form are the route.
Safe harbor. If you make a good-faith effort to stay in scope — testing against your own account and data, never accessing or exfiltrating anyone else's, and reporting privately before any public disclosure — we won't pursue legal action over that research, and we'll work with you to get it fixed.
Ground rules. Test against your own account. Don't run scans that could degrade the service for other customers, don't attempt to read or modify anyone else's data or code, and don't publish a report before we've had a chance to fix it — or 7 days have passed since you told us, whichever comes first.
In scope
- —nittim's production web app (nittim.com) and its API
- —The nittim GitHub App, and its OAuth / installation flow
- —The nittim MCP server
Out of scope
- —A finding inside an audit report itself — that's a product-accuracy issue, not a security issue; report it through the general contact form instead
- —Third-party services nittim depends on (GitHub, Anthropic, Supabase, Vercel, Stripe) — report those to the vendor directly
- —Denial-of-service or volumetric attacks against nittim's infrastructure
- —Social engineering against nittim staff or its customers
- —Automated scanning that degrades the service for other users