RepoX-Ray is designed with privacy as a core principle. No source code is ever transmitted to any server. All analysis runs locally in the user's browser.

If you discover a security vulnerability in RepoX-Ray itself (not in scanned repositories), please report it responsibly:

1. Do not open a public GitHub issue for security vulnerabilities
2. Email or open a private security advisory on GitHub
3. Include steps to reproduce and potential impact

Security reports should focus on:

• Data leakage from the browser application
• Bypass of local-only processing claims
• XSS or other web vulnerabilities in the app itself
• IndexedDB storage issues exposing sensitive data inappropriately

• Findings in user-uploaded codebases (that's the tool's purpose)
• False positives/negatives in secret detection patterns
• Architecture detection accuracy

• Secrets found during scans are masked by default
• Raw values are never persisted to IndexedDB
• "Reveal locally" shows values only in the current browser session

We aim to acknowledge reports within 48 hours and provide fixes for confirmed vulnerabilities as quickly as possible.