Your code never leaves your infrastructure. Here's exactly how.
Rosentic runs as a GitHub Action on your CI runner. Your source code is parsed locally, the conflict report is posted as a PR comment, and the runner is destroyed. No source code is stored, transmitted, or retained in any mode.
| What | Where it goes | Stored? |
|---|---|---|
| Your source code | Parsed on your GitHub runner | Never stored. Never transmitted. In any mode. |
| Conflict report | Posted as a PR comment on your repo | In your GitHub, not ours |
| Anonymous scan metadata (no key) | Rosentic telemetry | Counts only: languages, branches, conflicts, duration. No file paths, function names, or code. |
| Finding details (with API key) | Rosentic dashboard | File paths, function/route names, line numbers, verdicts, and layers. Never source code or diffs. |
| Docker image | Pulled from ghcr.io | Public image. You can inspect it. |
| Permission | Why |
|---|---|
contents: read | Read your repo's branches and files to analyze code structure. |
pull-requests: write | Post the conflict report as a PR comment. |
These are the minimum permissions. Rosentic does not request admin access, push access, or any other permissions.
Trivy-scanned. Every Docker image pushed to ghcr.io/rosentic/rosentic-engine is scanned with Trivy for known vulnerabilities before release.
Ephemeral. The container runs on GitHub's ephemeral runners. When the scan completes, the runner and all local data are destroyed by GitHub's infrastructure.
Deterministic. The engine uses static analysis only. No LLM inference. No network calls during scanning. No external API dependencies during the scan itself. Same input produces the same output every time.
Anonymous scan metadata helps us improve the engine. Here is exactly what is sent:
Rosentic has the same trust model as actions/checkout, actions/setup-node, or any other Action in your CI pipeline. It runs on your runner, uses your compute, and operates within your network. If your team already runs GitHub Actions, Rosentic requires no additional security review.
If your security team has questions about the Rosentic trust model, email [email protected]. We're happy to walk through the architecture with your team.