Security
Last updated: 29 October 2026
Stackat is built by people who do ISO 27001, SOC 2 and NIS2 work for a living, so we hold it to the same standard we audit others against.
How Stackat is protected
- Stackat only touches what you define: your infrastructure files (YAML, Terraform, HCL), and only the folders and file types you choose in
.stackat.yml. They are held in memory for each scan and gone as soon as it finishes; your application code stays on GitHub. (Very large repositories, tens of thousands of files, are fetched whole for the scan and deleted right after it.) Organisation, repository and user names are pseudonymised everywhere, including logs. - No AI ever sees your code. The model reads public release notes only, once per release; matching them to your files is plain code, and our tests fail the build if the scanning service ever gains an AI library.
- Release notes are treated as untrusted input: what the AI writes is checked and cleaned before it reaches your issues, so nobody can slip links, mentions or instructions in through a project's release notes.
- Scans run on our own servers in the EU, which have no open inbound ports: they are reached only through Cloudflare Tunnel. Administration sits behind Cloudflare Access and a second password; failed sign-ins lock out. Our GitHub organisation requires two-factor authentication.
- Every change is tested, audited for vulnerable dependencies and scanned before release, and rolls back automatically if it does not come up healthy. Data is backed up nightly.
- The pages of this website load no third-party scripts, except Cloudflare Turnstile on the survey form, and set strict security headers.
What the GitHub Apps can do
| App | Code | Issues | Pull requests |
|---|---|---|---|
| Stackpaw | Read and write (to push the bump branch) | Read and write | Read and write |
| Stackpaw Audit | Read only | Read and write | None |
Both apps only see the repositories you select and use no webhooks. Replies such as /stackpaw pr or
/stackpaw ignore are acted on only when they come from someone with a role in the repository; on a public repository,
anyone else's comment is ignored. Uninstalling stops everything; what Stackat kept is deleted
90 days later, or at once on request. Every subprocessor is listed in the data processing agreement.
Report a vulnerability
Email info@progrex.dev with what you found and how to reproduce it. We confirm receipt within 2 working days and keep you updated until it is fixed.
Please give us reasonable time to fix an issue before telling others, do not access or change other people's data, and do not run tests that disrupt the service (no denial of service, no spam, no social engineering). If you follow these rules in good faith, we will not take legal action against you. We do not run a paid bug bounty yet, but we will thank you publicly if you wish.
Also in machine-readable form: /.well-known/security.txt.