Security

The short version

• Every job runs in a fresh, disposable sandbox that is destroyed when the job ends.
• We store GitHub installation ids, never GitHub tokens. Tokens are minted per job, scoped to the selected repositories, and expire after one hour.
• compat can push branches and open pull requests. It cannot merge. There is no merge code path.
• The agent edits through a restricted tool set: no shell, no access to secrets, no hand edits to CI configuration or lockfiles.
• Repository content and fetched documentation are treated as untrusted input.

Access to GitHub

compat is installed as a GitHub App named compat-dev. During installation you choose which repositories it may see; it never has access to the rest of your organization. We persist the installation id and repository metadata (name, default branch, visibility). We do not persist installation access tokens.

When a job starts, the worker mints a new installation access token restricted to the repository being worked on. The token lives for one hour, is used for the clone, the push and the pull request, and is never written to the database, to job evidence or to logs.

Pushes are restricted to the branch namespace integration-maintenance/<provider>/<id>. compat cannot push to your default branch or to any branch outside that namespace.

Sandboxes

Each job clones the repository into a dedicated E2B sandbox. The sandbox is created for that job, runs the repository's own install, typecheck, test and build commands, hosts the agent's edits, and is destroyed when the job finishes, fails or is cancelled. Nothing from one job is visible to another, and compat keeps no persistent copy of your source code.

What the agent can do

The model does not get a shell. It works through a small set of tools with explicit guards:

• Read files, list directories and search within the cloned repository.
• Write files, except CI configuration and lockfiles, which it cannot edit directly. Lockfiles are regenerated by running your package manager.
• Run the repository's declared install, typecheck, test and build scripts, with output captured as evidence.
• Fetch provider documentation from an allowlist of hosts, with size limits and redirect guards.

It has no access to environment variables or secrets, no network beyond the documentation allowlist and the package registry, and no ability to interact with GitHub directly. Pushing and opening the pull request are done by the worker after the agent has finished, from recorded evidence.

Untrusted content

Files in your repository and documentation pages fetched during a job may contain text that tries to steer the model. compat treats all of it as data: instructions embedded in repository content or documentation cannot widen the tool set, change the branch namespace, or affect what the worker does after the agent finishes.

Evidence and redaction

The pull request body is rendered only from recorded evidence: each check is listed as passed, failed or not run with its duration. Command output stored as evidence is truncated and passed through a redaction step that removes token-shaped strings and known secret formats before it is saved.

Humans merge

A pull request opened by compat is a proposal. Review it the way you review any contributor's change, including the manual steps compat lists because it could not verify them itself. Merging is always a decision made by a person with write access to your repository.

Reporting a vulnerability

Write to hello@compat.dev with the details. We acknowledge within two business days during the design partner phase.