Read-only, by design
The devXOS GitHub App requests five permissions, all read-only: repository metadata, contents, pull requests, issues, and organization members. There is no write permission, no admin permission, no secrets permission, no workflow permission. devXOS cannot push, comment, open issues, change settings, or read your CI secrets.
Exactly what we read
From the GitHub API we read commit SHAs, messages, authors, committers, parent SHAs, and timestamps; pull request numbers, titles, authors, branch names, merged_at, closed_at, and review states; release tags and dates; the public member list of installed organizations; and, for issues linked to pull requests, their type, labels, epic and reopenings — never their body. When an organization enables the opt-in Alavex module, its pipeline also reads which of the lines each delivery changed are still there (git blame over the changed ranges), and whether the repository has test, CI, typing and documentation files. That is the full set — if a field is not in this list, devXOS does not request it.
What we never store
devXOS does not store source code. Without the Alavex module, nothing reads file contents: the contents permission serves the commit history endpoint, and we use it for commit metadata, not the code itself. With the module enabled, its pipeline clones the organization's repositories into a short-lived CI runner to run git blame, and keeps only counts — how many lines of each delivery survived — never code, diffs or file paths; the clone is deleted when the run ends. We also do not store webhook payload bodies beyond what is needed to update installation state.
GitHub App vs. OAuth login
Two separate GitHub authentications power devXOS, with strictly partitioned roles. The GitHub App reads your organization's data through scoped, revocable installation tokens minted per-request. The OAuth login is used only for identity — it tells devXOS who you are and which GitHub organizations you personally belong to, so we can match you to an existing workspace. The OAuth login never reads organization-level data on your behalf.
Revoking access
You can revoke the devXOS GitHub App at any time from your GitHub organization's Installed GitHub Apps settings, or from the devXOS settings UI. Revoking it cuts ingest immediately. On written request we also delete the metadata we have already ingested.
Privacy policy
This page documents what flows through our integration. For the broader data-handling policy, see our privacy policy.