Your code stays yours.
Railo works on your source code, so here is exactly what it touches, who can see it, and what we will never do with it.
With the free Action
Follow a change, start to merge.
Your pull request
A change is opened in your repository.
Your CI runner
Railo runs here. Scanning and fixing happen on your machine, not ours.
Your code stays hereA suggestion or fix PR
The fix comes back as a change on the line, or a separate pull request.
Your team merges
Nothing lands on a branch you own until a person approves it.
The one thing that leaves: a usage count
The repository name, mode, counts and scan time. Never source code. Set RAILO_TELEMETRY=0 and nothing is sent.
The GitHub Action
Runs in your CI. We never see your code.
- Scanning and fixing run inside your own GitHub Actions job. Source code is not sent to Railo.
- It authenticates with the workflow's GITHUB_TOKEN and only the permissions written in the workflow file.
- Fixes arrive as suggestions on the pull request, or as a separate fix pull request. It never pushes to your branches.
- A usage ping carries the repository name, mode, counts and scan time. Set RAILO_TELEMETRY=0 and it sends nothing.
A Fix Sprint
Done by us, under your NDA, with the least access the work needs.
- We sign your NDA before we get any access.
- Access is limited to the repositories in the sprint: read, and open pull requests. No production systems, no secrets.
- We work in a private clone used only for your sprint, and delete it when the sprint ends.
- Every change is a pull request your team reviews and merges. Your CI runs on it as on any other change.
What we never do
Four lines we do not cross.
No guessing at fixes.
Railo's automated fixes come from deterministic rules, not a language model: the same finding gets the same fix every time. Every other fix is written and reviewed by one of us before you see it.
No training on your code.
Your code is not used to train any model, ours or anyone else's.
No selling or sharing.
We do not sell, rent or share your data for marketing or advertising.
No direct commits.
Nothing lands on your branches without a person on your team approving it.
Evidence, not a certificate.
Railo does not hold SOC 2 or ISO 27001 certification, and it does not make your product pass an audit. It records what was found, what changed and how each change was checked, so you can hand that to your auditor. The conclusions are theirs.
What Railo recordsFound a vulnerability in Railo?
Tell us privately at zarif.latif@railo.dev. The reporting policy covers what to include and how we respond.
Security reporting policyQuestions from your security team?
We answer security questionnaires before a sprint starts. Or try the Action first: it never sends us your code.