What it means for YAGNI to read your code
Granting source-code access requires trust. We treat that seriously. Here we explain YAGNI's permissions, data handling, and the limits of what it can do.
How your code is handled
Read-only OAuth access
YAGNI asks only for repository contents access and pull request creation through OAuth. It does not request write access to your main branch, secrets, or settings. Review or revoke the grant anytime through your Git provider.
No long-term token storage
OAuth tokens are encrypted at rest and used only during active analysis. We neither store nor log source code between runs. Disconnecting a repository revokes its token and purges stored metadata within 30 days.
Analysis runs in isolation
Each run uses an ephemeral container with no network access or persistent filesystem. The container is destroyed afterward, and your code never shares infrastructure with another customer's analysis.
No model training
Your source code and analysis results are never used to train or fine-tune any model. This is contractual, not merely policy. The pipeline uses deterministic static and dynamic analysis tools, not a generative model influenced by your code.
The permission model
YAGNI uses layered trust: every pipeline stage receives only the access required for its task.
Security questions?
Have a specific security concern or compliance requirement before connecting a repository? Reach out directly to discuss it.