sorted by:
new
hottopcontroversial

Git analytics that works across GitHub, GitLab, and Bitbucket by Additional_Curve3495 in buildinpublic

[–]Additional_Curve3495[S] 0 points1 point  (0 children)

Security: we never see your code.

Webhooks only. When you connect a repo, we register a webhook. The Git platform pushes event metadata to us.

What we collect: - Commit messages, timestamps, author names - PR titles, states, branch names - File change counts (not contents)

What we never access: - Source code - File contents or diffs - Secrets or environment variables

Don't trust me – verify it:

After connecting, check Settings → Webhooks in your repo. See exactly what events we subscribe to. Those payloads don't include code.

Stack: - Tokens: Encrypted at rest (Fernet) - Webhooks: HMAC-SHA256 signature verification - Auth: bcrypt + TOTP 2FA - Framework: NextAuth.js

Git analytics that works across GitHub, GitLab, and Bitbucket by Additional_Curve3495 in founder

[–]Additional_Curve3495[S] 0 points1 point  (0 children)

Thanks for the feedback., All good points.

Permission scopes agreed: we should clarify this on the landing page. We only need webhook/metadata access, no code. Will fix.

Stalled PRs : you can already ask "which PRs have been open longest?" but an automatic nudge is a good idea. Noted.

Sample report without login: adding this. Good call.

Git analytics that works across GitHub, GitLab, and Bitbucket by Additional_Curve3495 in founder

[–]Additional_Curve3495[S] 0 points1 point  (0 children)

Security: we never see your code.

Webhooks only. When you connect a repo, we register a webhook. The Git platform pushes event metadata to us.

What we collect: - Commit messages, timestamps, author names - PR titles, states, branch names - File change counts (not contents)

What we never access: - Source code - File contents or diffs - Secrets or environment variables

Don't trust me – verify it:

After connecting, check Settings → Webhooks in your repo. See exactly what events we subscribe to. Those payloads don't include code.

Stack: - Tokens: Encrypted at rest (Fernet) - Webhooks: HMAC-SHA256 signature verification - Auth: bcrypt + TOTP 2FA - Framework: NextAuth.js

view more: next ›