Operating
Privacy & security
Privacy is the product. These are hard rules, not best-effort goals.
Hard rules
- No source upload by default. MCP sends metadata only.
- No PAT storage. Auth uses GitHub Device Flow.
- No wallet or hotkey display.
- No raw trust-score display.
- No payout/reward guarantees, anywhere.
- No farming language.
- No public score estimates.
- No private reviewability details in public GitHub output.
Public output rules
- At most one sticky sanitized comment per confirmed-miner PR.
- At most one configured label per confirmed-miner PR.
- Public comments are maintainer-friendly and non-shaming.
Auth
- Public endpoint:
GET /health. - Private API uses Bearer / session tokens.
- MCP CLI uses GitHub OAuth Device Flow.
- Static bearer tokens remain internal / bootstrap only.
Website copy may discuss private scoreability and risk reasoning, but it's always framed as private MCP/API context. The public web never carries score numbers.