Here is exactly what happens to it, what we keep, and what you get back — so you can decide before you grant anything rather than after.
Through GitHub’s own App install, so you choose the repositories and you can revoke it in one click without talking to us. Read access to code and metadata. Nothing else — not issues, not actions, no write access to anything.
What it does, who maintains it, when you launch, and what is already worrying you. A scanner does not know that the database holding your customer records is the one you spun up in an afternoon. The person reading your results needs to.
Your repository is cloned into a container with no outbound network access, scanned against 28 production-readiness checks, and the container is destroyed. The clone goes with it.
The part you are actually paying for. A machine can tell you a key is exposed; it cannot tell you which three of nineteen findings matter before Thursday. Free, you see your top three findings and your score — enough to know whether the rest is worth having.
Thirty minutes with the engineer who wrote your read. Reports get skimmed and filed; this is where you ask why something is critical, what happens if you leave it, and what to do first on Monday.
Some people take the read and do the work themselves, which is a fine outcome and the reason the read stands on its own. If you would rather not, Deop’s engineers close the critical and high findings in a fixed-price sprint — the same people who read it, so nothing is explained twice.
The short answer is nothing, unless you ask us to.
Retention is opt-in. If you want a re-scan later, or a remediation sprint that carries the findings forward, you tell us and we keep them. Otherwise the source is purged after your report is delivered — that is a command we run, not a habit we rely on.
A model drafts a first pass at each finding, from that finding's metadata only — rule identifier, category, severity, file path, line numbers. Your source is never sent, and that boundary is an allow-list of what we send rather than a list of things we strip out.
That drafting runs outside Canada. Your code does not go with it. We write both sentences because only one of them is the reassuring one.
The X-ray is free. One repository, your top three findings, and a readiness score. No card, no call.
The full read is $750 — all 28 checks, a senior engineer's priority list, stack risk, a skills assessment, an enterprise readiness track, and a 30-minute call. Delivered within 48 hours.
You see the free result before you decide anything.