Security at Pullora

Pullora reviews source code, which means we handle some of the most sensitive data an engineering team has. This page describes, factually, how the product is designed to protect it.

Access to your code

• Pullora connects through a GitHub App with least-privilege permissions. Access is scoped to the repositories you select during installation, using short-lived installation tokens.
• We do not use personal access tokens and do not retain standing broad access.
• Code is fetched on demand for a review. We store review metadata and findings — not full copies of your repositories.

AI providers

• Diffs and context are sent to our AI providers (such as Anthropic and OpenAI) under API terms that do not permit training on your data.
• Repository content is treated as untrusted data: it is fenced in prompts and never interpreted as instructions, which mitigates prompt-injection attacks embedded in code or comments.
• AI output is schema-validated before anything is published; malformed output is never posted to your Pull Requests.

Application security

• Provider credentials are encrypted at rest with AES-256-GCM.
• All webhooks (GitHub, Razorpay) are signature-verified and idempotent before any processing occurs.
• Secrets and tokens are never written to logs.
• Role-based access control governs every workspace action, and sensitive operations are audit-logged.
• API endpoints are rate-limited.

Payments

Payments are processed by Razorpay. Pullora never sees or stores your card details; we store only subscription state and payment records returned by the processor.

Compliance

We do not currently claim third-party certifications. If your organization has specific compliance or deployment requirements, contact us and we will describe our current posture in detail.

Reporting a vulnerability

If you believe you have found a security issue, please email security@pullora.ai. We appreciate responsible disclosure and will respond as quickly as we can.