We keep the shit contained.

APESHITE stores account, project, scan and report data needed to provide the service. Public URL scans may be shared through a report link when a scan is marked public.

Do not submit passwords, private credentials, API keys or other secrets into scan targets or report content. APESHITE is designed to inspect public application signals and should not be used as a secret-storage system.

Repository integrations are designed around least-privilege access. We will expand the repository and automated-fix features over time, with access controls and user authorization kept explicit.

We do not need an AI provider to run the core deterministic scanner. Optional AI features can be added later without making basic scanning dependent on an AI API.