Useful signal. Minimal blast radius.
Agentprint treats conversation content as data it should not possess.
Collection boundary
The Claude Code connector disables prompt, response, tool-detail, tool-content, and raw-body telemetry. The API applies a second recursive sanitizer and a per-event allowlist before data can be persisted.
Credentials
GitHub authentication is handled by Supabase Auth. Installation tokens are random, stored only as SHA-256 hashes on the server, and kept in the operating system keychain locally. Device codes are short-lived and single use.
Data access
Raw telemetry, partitions, device codes, and token hashes have no anonymous or browser grants. Public profiles are produced by a constrained aggregate function. Row-level security limits account data to its owner.
Report a vulnerability
Please send security reports to ruval.labs@gmail.com. Include reproducible detail and allow a reasonable remediation period before public disclosure.