Security
What Tough Crowd can access, what we keep, who else sees your code, and where we're still catching up.
Last updated October 13, 2026 · Questions: security@toughcrowd.dev
In short
- Training
We may use your data to train and improve Tough Crowd. An opt-out for organizations is coming soon.
- Models
Agents run on your own Anthropic or OpenAI account. Small tasks like session titles and commit messages use our account and never see file contents.
- Code
Each session clones your repo into its own sandbox. We keep session changes and agent conversations for as long as your account is open.
- Secrets
Encrypted in our database. Today they're set in the session's sandbox; soon agents will get proxies they can use but not read.
- Compliance
Built with SOC 2 in mind. We plan to get a SOC 2 report, but haven't started the audit yet.
GitHub permissions
You install the Tough Crowd GitHub App on your organization or personal account and choose which repositories it can access. It requests only repository permissions, none at the organization or account level. Agents in a sandbox get a short-lived token that works only for that session's repository.
| Permission | Access | Why |
|---|---|---|
| Contents | Read & write | Clone your repository, push the branches agents work on, and merge |
| Pull requests | Read & write | Open and update pull requests, post reviews, and merge |
| Checks | Read & write | Read CI results and publish each review as a check |
| Commit statuses | Read | Read CI statuses before a merge |
| Actions | Read | Read workflow runs and logs to diagnose and fix failing CI |
| Workflows | Read & write | Push changes that edit GitHub Actions workflow files |
| Issues | Read & write | Sync GitHub issues with Tough Crowd issues and comment on pull requests |
| Deployments | Read | Track which changes have reached production |
| Metadata | Read | Required by GitHub for every app |
Events Tough Crowd receives
GitHub notifies the app about these events in the repositories you choose.
| Events | Why |
|---|---|
| Pull request, pull request review, review comment, review thread, issue comment, commit comment | Start reviews on new pull requests and keep comments and threads in sync |
| Check run, check suite, status, workflow run, workflow job | Follow CI results so agents can fix failures |
| Push, deployment, deployment status | Notice new commits and track what reached production |
| Issues | Sync GitHub issues with Tough Crowd issues |
| Repository, installation target | Keep your repository list current |
Your code and data
Each session clones your repository into its own sandbox, which is deleted when the session is done. We keep each session's changes and the full history of its agent conversation, including code the agent read, for as long as your account is open.
We keep this history to improve Tough Crowd for you. By studying past conversations, diffs, and changes against your full codebase, we can help you optimize agent behavior and suggest improvements to your review prompt and model choice.
We may also use your data to train and improve Tough Crowd more broadly. An opt-out for organizations is coming soon; once an organization opts out, its data will be used only to provide Tough Crowd to it.
When you close your account, we delete it all after a 24-hour grace period. Database backups are kept for 7 days, so deleted data is gone from backups within 7 days.
| Data | Kept? | For how long |
|---|---|---|
| Repository checkout | In the session's sandbox | Deleted when the pull request merges or closes, or 7 days after the session goes idle |
| Prebuilt sandbox snapshots | With our sandbox provider | Until your repository's setup changes, or you close your account |
| Diffs and changed files | Yes | Until you close your account |
| Agent conversations: prompts, messages, tool calls, and output | Yes | Until you close your account |
| Review findings | Yes | Until you close your account |
| Secrets | Yes, encrypted | Until you delete them or close your account |
Who sees your code
These are the services that handle your data, and what each one sees. Today, agents call Anthropic or OpenAI directly from their sandbox. When secret proxies arrive, all sandbox traffic, including model requests, will pass through our proxy, which adds your credentials so they no longer sit in the sandbox.
| Service | Used for | What it sees |
|---|---|---|
| Anthropic or OpenAI, on your account | Agent model calls | Your prompts and the code and files the agent reads |
| Anthropic or OpenAI, on our account | Session titles and commit messages | Task prompts, changed file names, and diff stats. No file contents. |
| E2B | Agent sandboxes and prebuilt snapshots | Full repository checkout and the secrets set in the sandbox |
| Amazon Web Services | Hosting, database, and storage | Diffs, changed files, agent conversations, review findings, and encrypted secrets |
| GitHub | Repositories and pull requests | Your repositories, and the reviews and branches we publish |
| Braintrust | Monitoring our own model calls | The same prompts, file names, and diff stats as above |
| rrweb Cloud | Session recordings of the Tough Crowd app | What's on screen. Form inputs, terminals, source code views, and diffs are hidden. |
| Resend | Transactional email | Your email address. No code. |
Model usage on your account is covered by your agreement with Anthropic or OpenAI.
Agent sandboxes
Each session runs in its own E2B sandbox, a lightweight virtual machine that isn't shared with other sessions or customers. Sandboxes can reach the internet so agents can install dependencies, but nothing can connect into one except through Tough Crowd after you sign in.
A sandbox pauses after 5 minutes without activity and is deleted when its pull request merges or closes, or 7 days after it goes idle. Prebuilt snapshots are made with GitHub tokens and secrets removed.
Prompt injection
Agents read pull request code, and that code can contain instructions aimed at them. An agent in a sandbox can reach your repository through a short-lived token that works only for that repository, the secrets and model credential set in its sandbox, and the internet.
It can't reach your other repositories, other customers' sandboxes, or the credentials Tough Crowd uses to run. Agents can push branches and open pull requests, but merging needs a person to confirm.
Secrets
Your repository's config lists the secrets a session needs, and you add their values in Tough Crowd. When a session starts, the secrets it needs are decrypted and set as environment variables in its sandbox, where setup scripts, dev servers, and the agent can use them.
| Question | Answer |
|---|---|
| Where are secrets stored? | In our database, encrypted with AES-256-GCM. |
| Can the agent use a secret? | Yes. |
| Can the agent read the value? | Today, yes: secrets are environment variables in the sandbox. Soon, no: the sandbox will only hold a proxy. |
| Is it sent to the model provider? | Not by Tough Crowd. Today an agent can read a value, so it could include it in what it sends. |
| Does it appear in logs? | It can. Logs and agent conversations aren't scanned for secret values, so a secret printed during a session is stored with it. |
| Can anyone see a value after it's saved? | No. Tough Crowd only shows whether a secret is set. |
| Who can replace or clear it? | Only you. Secrets belong to your account. |
Compliance and infrastructure
We've designed Tough Crowd with SOC 2's requirements in mind, and we plan to get a SOC 2 report. We haven't started the audit yet, and we'll update this page when that changes.
Tough Crowd runs on Amazon Web Services in the US (us-east-1). Our Aurora database, including its logs, backups, and snapshots, is encrypted at rest with AES-256 using an AWS-owned key. Secrets, model API keys, and OAuth tokens have an additional layer of encryption with AES-256-GCM before they're stored in the database. Connections from your browser to Tough Crowd use HTTPS.
Our CDN, CloudFront, currently talks to our servers over unencrypted HTTP.
We haven't had a third-party penetration test yet, and plan to get one ahead of our SOC 2 audit. In the meantime, we're part of OpenAI's Daybreak Blue program for approved security defenders, and use Codex to scan our codebase for vulnerabilities. A Data Processing Agreement (DPA) for customers is coming soon.
Removing access
- Disconnect GitHubDisconnect GitHub in Settings, or uninstall the app from GitHub. Tough Crowd stops reviewing and working on your repositories.
- Disconnect your model providerDisconnect ChatGPT or delete your API keys in Settings. Agents can't run until you connect one again.
- Delete your dataClose your account in Settings. We delete your data 24 hours later, and it's gone from backups within 7 days.
Reporting a vulnerability
Email security reports to security@toughcrowd.dev. We acknowledge reports within 5 business days, and we email affected customers about any incident that affects their data.