Understanding Makrly’s Security and Privacy Practices

GitHub access

Makrly reads repository metadata, commit messages, diffs, and author information for generation. Diffs can contain source code. Private repositories require GitHub’s repo OAuth scope, which also permits writes. Makrly uses the connection for product reads and webhook management.

Review requested permissions when connecting GitHub. You can revoke Makrly’s authorization through your GitHub OAuth app settings.

Credential storage

Developer Bearer keys are stored as SHA-256 hashes and can be revoked. Their full value is shown once when created.

Newly saved AI provider credentials and GitHub tokens are encrypted at rest with AES-256-GCM. These provider credentials differ from the hashed developer keys used to authenticate Makrly API requests.

API protections

Owner API operations check authentication, feature scopes, repository ownership, input bounds, and rate limits. A key restricted to one repository cannot access another repository through a related resource. Keep developer keys server-side.

Export and privacy information

To download saved account data, open Settings, select Account, and choose Export My Data. The JSON export excludes credential values.

Read the Privacy Policy and Terms of Service for the applicable policies. See current product documentation for the integration and security details summarized here.