StackRX uses a Supabase OAuth integration configured with read permissions required to inspect project and database state. Scanner operation does not request database-write access and does not require your service-role key or database password.
StackRX uses a GitHub App installed on repositories you select. Read access powers scanning. Contents and pull-request write permissions exist for the explicit Founder/Agency Fix PR feature. Installation tokens are short-lived and generated server-side.
Supabase OAuth access and refresh tokens are encrypted at rest with AES-256-GCM using a server-only application encryption key. GitHub installation tokens are not persisted.
Repository content is fetched into the scanning worker within bounded limits. StackRX stores structured findings and the minimum evidence needed to explain them rather than archiving entire repositories by default.
StackRX does not auto-apply database changes and does not auto-merge pull requests. A generated fix is a proposed code/migration change that still belongs in your normal review and deployment process.
AI may make a deterministic finding easier to understand. It cannot downgrade a rule, override a deploy blocker, or turn missing scan evidence into a green release gate. Detected secret values are redacted before optional AI explanation.
Add the final monitored security-contact address before production launch.
