What it can touch, and what it keeps
GitHub shows the permissions an App asks for without saying why. Here is why PullPuppy needs each one, where your code goes during a review, and what is stored afterwards.
GitHub permissions
| Permission | Access | What it is used for |
|---|---|---|
| Pull requests | Write | Read pull requests, their files and review threads; post reviews with inline comments; edit and dismiss its own reviews; reply to and react to commands. |
| Contents | Write | Read the repository to check it out for the review. Write is used for one thing only: resolving its own review threads, which GitHub does not allow without it. |
| Checks | Write | Create and update the pullpuppy check in gate mode, and notice when someone re-runs it. |
| Issues | Read | GitHub requires it to deliver pull request comments, which is where commands are written. Nothing is written to issues. |
| Metadata | Read | Required for every GitHub App. Also used to check who has write access before following a command, and to list repositories. |
It asks for no organisation or account permissions.
PullPuppy never pushes commits, creates branches or edits files. Contents: write is there only because GitHub refuses to let an App resolve review threads without it. A token with write access is created only for that call and for hiding the bot's own outdated reviews. The part that runs the model gets a read-only token for a single repository, and that token is removed before the model starts.
You choose which repositories the App can see. Picking Only select repositories when you install keeps that list short.
In request-changes and gate modes, an approval from PullPuppy is a real GitHub approval and counts toward a branch's required approvals. A rule can turn approving off.
Where your code goes
- Each review runs in its own disposable container. Your code never shares a process or a disk with another customer's, and the checkout is deleted when the review ends.
- The container can reach GitHub, OpenAI and the service's own API, and nothing else. The model's tools inside it can read files; they have no network and cannot write.
- The diff and the files the model reads are sent to OpenAI under your API key, to produce the review.
- Nothing in your repository is installed, built or run: no dependency install, no tests, no scripts.
- Your code does not appear in the service's application logs.
What is stored, and for how long
| What | How long |
|---|---|
| Pull request title, description, author and branches | Your retention period (90 days unless you change it) |
| Findings: title, explanation, suggested code, file and lines | Your retention period |
| The model's structured result | Your retention period |
| The review log: tool calls and the names of files read | 14 days |
| Webhook delivery ids and a short summary | 7 days |
| The checkout of your repository | Deleted when the review ends |
Your retention period can be set anywhere from 7 to 730 days. A review is kept past it while one of its findings is still open on the pull request, because the next review needs it.
Uninstalling the App stops all reviews and deletes your OpenAI API key at once. Everything else is deleted 30 days later, in case you reinstall, or sooner if you ask. Nightly database backups keep a copy for up to 30 more days.
Keeping organisations apart
- Every query is scoped to your organisation, and the database enforces the same separation underneath with row-level security.
- Your OpenAI API key is stored encrypted. It is never shown again after you enter it; the dashboard shows only its last four characters.
- Sign-in is through GitHub. You see an organisation's reviews only if GitHub says you can access its installation.
Pull requests are treated as untrusted
Titles, descriptions, comments and code are data to PullPuppy, never instructions. The model holds no GitHub credentials and has no way to write, and the verdict is computed by the service rather than the model. A pull request written to mislead the reviewer can at worst produce wrong findings. It cannot approve itself.