Privacy

To scan a repo, Bugbear pulls the relevant source into an isolated, ephemeral sandbox, runs the agents, and discards the working copy when the scan finishes. We do not persist your source code or its git history. What we keep is the report: findings (file, line, severity, exploit path, and a suggested fix) plus scan metadata (repo name, branch, commit, grade, timing).

Account and entitlement data (your plan and Bugbear-token balance) live in Clerk. Findings and scan metadata live in a managed Postgres database (Neon). Payment details are handled entirely by Dodo Payments — we never see or store your card number.

When you install the Bugbear GitHub App, we use a short-lived, per-installation token to read the code we scan and to post pull-request checks. We request the narrowest scopes needed and never use your token for anything other than the scan you asked for.

If you provide a deployed URL, Bugbear makes a small number of non-intrusive requests to inspect security headers, cookies, CORS, and basic performance. The probe blocks private and internal network ranges and never attempts to exploit the site.

We do not sell personal data or share it with advertisers. We use it only to run the product you signed up for.

You can export or delete your scan data, or close your account, at any time. Email support@bugbear.sh and we'll take care of it.