Security

Each scan runs against a fresh, isolated copy of your source that is discarded when the scan completes. Source code is not written to long-term storage; only the resulting findings and scan metadata are persisted.

Private-repo scanning uses the GitHub App with short-lived, per-installation tokens scoped to the repositories you choose. Tokens are used only for the scan and PR checks you request, and you can revoke the installation from GitHub at any time.

When an agent finds a leaked credential, the report tells you where it is and how to rotate it — we don't copy the secret out or retain it. Findings store the location and remediation, not the raw secret material.

The optional deployed-URL probe is read-only and non-intrusive. It resolves and rejects private, loopback, link-local, and cloud-metadata addresses on every redirect hop, so it can't be pointed at internal infrastructure.

Authentication is handled by Clerk and payments by Dodo Payments; Bugbear never stores passwords or card data.

Found a vulnerability in Bugbear itself? We want to hear about it. Email support@bugbear.sh and we'll respond quickly. Please give us a reasonable window to fix issues before public disclosure.