Repository selection
Installation is controlled through GitHub. Administrators can choose selected repositories instead of granting access to every repository in an organization.
Security overview
Clear access. Human control. Honest boundaries.
This page explains the customer-visible security model of Qedix without publishing proprietary detection methods, internal infrastructure, or bypassable implementation details.
Customer-visible security model
The practical controls developers and administrators can evaluate before installing Qedix.
Purpose-limited access
Qedix requests GitHub permissions associated with identifying pull-request context, reading relevant code, and publishing its check result.
Temporary source processing
Qedix does not retain a persistent full-repository copy. Temporary working copies are designed to be removed after processing, with cleanup for interrupted runs. Selected metadata and report evidence may be retained as described in the Privacy Notice.
Maintainer authority
Qedix provides advisory evidence. It does not automatically merge pull requests, approve releases, or deploy customer software.
GitHub App permissions
The current repository permissions and the customer-visible reason for each one.
PermissionAccessWhy Qedix requests it
Permission
Metadata
Access
Read
Purpose
Identify the installation, repository, and pull-request context needed to operate the GitHub App.
Permission
Contents
Access
Read
Purpose
Review relevant JavaScript and TypeScript changes and the repository context required for an advisory report.
Permission
Pull requests
Access
Read
Purpose
Understand the changed files, pull-request state, and review context associated with an analysis.
Permission
Checks
Access
Read and write
Purpose
Publish and update the Qedix check result that maintainers can inspect from the pull request.
User sign-in may request the GitHub OAuth scopes read:user and user:email to identify the signed-in user and obtain available account email information. OAuth identity scopes are separate from repository installation permissions.
Installation control
GitHub administrators retain control over where Qedix is installed.
- 01
Install
A GitHub organization or repository administrator starts the installation through GitHub.
- 02
Select
The installer chooses which repositories the GitHub App may access.
- 03
Review
Maintainers inspect Qedix results as advisory evidence alongside their existing review process.
- 04
Change or remove
Authorized administrators can change repository access or uninstall the GitHub App through GitHub.
GitHub-visible check results or reports created before access is removed may remain where GitHub or an authorized user previously received them.
Security and review boundaries
Precise limitations are part of a trustworthy product.
Advisory, not autonomous
Qedix supports maintainers with production-readiness evidence. The team remains responsible for review, testing, approval, release, and deployment decisions.
Not a complete security program
Qedix should operate alongside automated tests, type checking, linting, security tooling, code review, staging, monitoring, and incident response.
Results depend on available evidence
Coverage depends on the changed code and context visible during analysis. A clean or low-severity result is not a guarantee that code is defect-free or secure.
Suggested tests are recommendations
A suggested test describes verification your team may perform. It does not mean Qedix executed that test or observed its result.
Report a security concern
Use coordinated disclosure for suspected vulnerabilities involving Qedix.
Last reviewed: July 14, 2026. This overview describes the current public beta and may be updated as customer-facing controls and product capabilities evolve.