Security and trust
What we touch, and what we cannot.
Moonray AI reads the repositories you install it on, comments on pull requests, and runs tests and browser sessions in isolated environments against test data. It holds no merge permission, changes no code without a person accepting it, and cannot reach production.
Limits we cannot quietly change.
These are properties of how the product is built, not settings. If any one of them stopped being true, it would be a different product and we would have to say so.
- We do not merge, and we do not block.
- Moonray AI gives a view and your team decides. Your branch protections, approval rules and merge permissions remain entirely yours, and nothing we do can hold a change up.
- We do not change code without being asked.
- Every suggestion is a proposal that a person accepts or rejects.
- We run tests in isolation.
- Testing happens in a separate environment with test data, never against anything live. Actions that reach outside the system, such as sending emails or taking payments, are blocked.
- We never treat quiet as safe.
- If we did not check something, we say we did not check it. Finding nothing is not the same as there being nothing to find, and we do not let the two be confused.
- We do not claim more certainty than we have.
- Telling a team something is fine when it is not is the one failure this product cannot afford, and we design against it harder than against anything else.
How your code is handled.
- What we read
- The repositories you install us on, and the tickets linked from the pull requests we review. We build an index of the code so reviews can be specific to your system. We do not read repositories you have not installed us on.
- What we write
- Comments and a written description on the pull request, and proposed tests attached to it. Nothing enters your repository without a person accepting it. We hold no merge permission and cannot acquire one.
- Where tests run
- In an isolated environment against test data, never against production and never against anything live. Actions that reach outside the system, such as sending email or taking payment, are blocked at the boundary rather than trusted not to fire.
- Where browser sessions run
- Against the preview or staging environment you point us at, using whatever credentials you provision for that environment. We do not ask for production credentials and there is nothing useful we could do with them.
- What we keep
- The assessment, the findings, the evidence produced during the review, and whether your team agreed with the position. That last one is what the product is tuned against.
Security questions go straight to us.
For security review, data handling questions or vulnerability reports, email security@moonrayai.com. We will confirm receipt within two working days.
See it on your own pull requests.
We install on one repository, let Moonray AI assess the next changes your team opens, and go through what it found with you. If the position is not better than what you have now, you will know within a week.
Nothing to host. Reviews begin on the next pull request opened.