Security & Access
0Day asks for access to your GitHub organization, so you deserve a precise answer to the obvious question: what exactly can it see, what does it store, and how do you turn it off? This page is that answer. If anything is unclear, email support@0dayalerts.com.
1. What the GitHub App can access
The 0Day GitHub App is installed at the organization level with read-only permissions. It reads dependency manifests and GitHub’s dependency graph: the machine-readable list of packages and versions each repository declares (an SBOM). That is the entire access surface:
- Dependency manifests and dependency graph: read-only. Files like package-lock.json, go.mod, requirements.txt, and GitHub’s computed dependency graph.
- Repository names and organization membership: so alerts can say which repo is affected and reach the engineers who own it.
What it can never do:
- Read the contents of your source files
- Write, commit, or open pull requests in your repositories
- Access issues, discussions, secrets, environments, or CI configuration
- Act outside the repositories you granted it during installation
2. What we store
| What | Why | Where |
|---|---|---|
| Package names and versions per repository | Match incoming threat intelligence against what you actually ship | AWS eu-west-3 (Paris, EU) |
| Repository names and org identifiers | Tell you which repo an alert affects | AWS eu-west-3 |
| Member emails and device push tokens | Deliver alerts to the right engineers | AWS eu-west-3 |
We never store your source code, because we never receive it in the first place. Threat classification uses AI models that only process the text of public security advisories and articles, never anything from your organization. Full details are in the privacy policy.
3. How data flows
The pipeline is one-directional and simple: GitHub’s dependency graph is read into our matching engine in the EU; independent threat intelligence from 20+ public sources flows into the same engine; when a threat intersects a package and version your organization uses, a push notification goes out to your engineers. Nothing flows back into GitHub, and your dependency data is never shared with, or visible to, any other organization.
4. Revocation
Uninstall the 0Day app from your GitHub organization settings and all access ends immediately; there are no cached credentials that outlive the installation. You can also delete your organization’s stored data by emailing support@0dayalerts.com; we respond within 30 days, usually much faster.
5. Our own security posture
- EU data residency: all stored data lives in AWS eu-west-3 (Paris). See the privacy policy for the full processor list.
- Minimal attack surface: serverless architecture (AWS Lambda + DynamoDB), no long-lived servers to patch, no analytics or tracking SDKs anywhere in the product.
- GDPR compliance: documented lawful bases, instant in-app account deletion, named EU supervisory authority.
- Honest roadmap: 0Day is an independent product; SOC 2 certification and third-party penetration testing are planned as the organization product matures. We’d rather tell you that plainly than imply otherwise.
6. Reporting a vulnerability
Found a security issue in 0Day itself? Email support@0dayalerts.com with details. We read every report, respond quickly, and credit reporters who want to be credited.