Security & Trust

Last updated: April 27, 2026

Fixor reads pull request diffs and writes back security findings. Anyone trusting Fixor with their code has a right to know what we hold, who else touches it, and how to tell us when we've done something wrong. This page is the short version — the longer narrative is in our Privacy Policy and the operator-facing roadmap in our public repository.

1. Security practices

Concrete things shipped today, not aspirations:

HMAC-verified webhooks

Both inbound webhook surfaces — GitHub (scan trigger) and Paddle (billing) — verify HMAC-SHA256 signatures on every request before parsing the body. The Paddle path enforces a 5-minute replay window.

Short-lived GitHub tokens

Fixor authenticates with GitHub via the App's installation tokens, which expire within 1 hour. We don't hold a long-lived personal access token for any user.

Diffs are not stored

The PR diff is processed in memory by the analysis engine and is not written to our database. Cost ledger and scan history rows track that a scan ran (and what it cost) without storing the code itself.

Signed report URLs

PDF + SARIF reports live on Cloudinary as authenticated assets. The PR comment links to a signed URL with a 1-hour TTL by default; the URL only proves the holder reached the comment within that window.

Hashed API tokens

API tokens (the fxr_* values) are 256-bit random strings. We store only their SHA-256 hashes; the plain token is shown once at creation and never again. A leaked DB dump can't be used as tokens.

Per-org budget caps

Every org has a hard monthly Anthropic spend cap (free=$5, indie=$30, pro=$80, team=$200). Scans pause at 100% rather than overspending; an 80% nudge fires earlier in the PR comment + email + dashboard.

Redacted structured logs

Server logs go through Pino with explicit redaction for ANTHROPIC_API_KEY, GitHub App private keys, and billing identifiers. console.* outside test scripts is banned in CI.

TLS everywhere

Database (Neon), Anthropic, Paddle, GitHub, Resend — every outbound connection runs over TLS. The marketing + dashboard surfaces enforce HTTPS via Vercel / GitHub Pages.

The full source is open, MIT-licensed, and reviewable at github.com/tornidomaroc-web/fixor — the security claims above are checkable against the code.

2. Subprocessors

We use the following third parties to operate Fixor. Each has its own security posture and certifications — click through for theirs.

SubprocessorPurposeRegion
AnthropicDiff analysis (Claude API)USA
NeonPostgres databaseUSA / EU
RailwayBackend webhook + analysis runtimeUSA
VercelDashboard hostingUSA / EU
ClerkGitHub OAuth + dashboard sessionsUSA
PaddlePayments + merchant of recordUSA / EU / UK
ResendTransactional emailUSA
CloudinaryPDF + SARIF report hostingUSA
SentryError trackingUSA
GitHubWebhook source; Fixor is a GitHub AppUSA

3. Compliance posture

4. Vulnerability disclosure

Email support@fixor.dev with subject line SECURITY: followed by a one-line summary. Mention “disclosure” in the body.

We'll acknowledge within 72 hours and follow up with a triage decision within 5 business days.

In scope

Out of scope

Safe harbor

Good-faith research that follows this scope and stops at proof-of-concept will not result in legal action from us. Don't exfiltrate data, don't run automated scanners that affect availability, and don't go after other customers' data — if you find a way to read another org's rows, stop, and tell us.

5. Incident communication

Live status: status.fixor.dev tracks four monitors (landing, dashboard, backend, Anthropic edge). Subscribe there for incident emails. Material data-breach notifications go to the email on each affected org's record (the installer email captured at first dashboard sign-in) within 72 hours of confirmation.

6. Data subject requests

For access, deletion, or export of data Fixor holds about your org, see the “Your rights” section of our Privacy Policy. Requests go to support@fixor.dev and are answered within 30 days.