Security

How Verdict handles your code

Draft, pending legal review (ZAV-42). This page describes how Zavton Verdict is designed to work. It is not yet a binding policy, and it will be replaced before anyone installs Verdict on a private repository.

Is my code stored?

No. Code from a pull request is fetched when the review starts, processed in memory, and discarded when the review ends. We keep a record of the review (the verdict, each finding’s file, line and severity, and your feedback), not the code.

Who sees my code?

Only our own review service and our own model, Zavton CR-1. Your code is not sent to third-party AI providers.

Do you train on my code?

No, unless your organisation explicitly opts in.

What can the GitHub App access?

Only the repositories you select when you install it, with only the permissions a review needs: reading code and pull requests, and writing review comments.

How do I remove Verdict?

Uninstall the GitHub App. Verdict stops reviewing immediately and loses access to your repositories.

How do I report a vulnerability?

A security contact address is published here before the private alpha opens.