What Sheaf can read
GitHub shows these permissions on the install screen. You pick the account and the repositories there, and you can change them later in your GitHub settings.
| Permission | Access | Why Sheaf needs it |
|---|---|---|
| Issues | read | Titles, labels, states and the first lines of the body for the inbox |
| Pull requests | read | Open and draft pull requests, review requests |
| Dependabot alerts | read | Vulnerable packages and their severity |
| Code scanning alerts | read | Code scanning results, grouped per repository |
| Secret scanning alerts | read | That a secret leaked, and where. Never the secret value |
| Metadata | read | Repository names, required by GitHub for every app |
| Email addresses | read | Your email, so that Sheaf can create your account |
What Sheaf cannot do
- Push code, open or close issues, comment or change settings. Sheaf has no write permission.
- Read your code or file contents.
- See a repository that you did not select at install.
- Install itself in an organization. An organization owner must approve it.
How data is kept
- The app runs on Cloudflare Workers. All traffic uses HTTPS.
- The database is Postgres on Neon, in the AWS Singapore region (
ap-southeast-1). - Your session lives in a cookie that scripts cannot read (
HttpOnly,Secure). - The sign-in tokens that GitHub gives Sheaf are stored encrypted, so that Sheaf can list your installations.
- The app private key and the webhook secret live in Cloudflare encrypted secrets, not in the code.
- Every page is served with HSTS, and other sites cannot show it in a frame.
- Each IP address (or IPv6 /64 network) can make about 600 API requests a minute, and each user can start 10 syncs a minute.
Webhooks
GitHub sends every change to Sheaf as a webhook. Sheaf checks the X-Hub-Signature-256 header against the webhook secret and drops every request that does not match. Polar sends billing changes the same way, signed with its own secret, and Sheaf checks that signature too.
Remove access
Uninstall the Sheaf app in your GitHub settings under Applications. Sheaf then deletes the installation and every issue, pull request and alert it stored for it. To delete your Sheaf account too, use Delete account in Settings, then Profile. The same page lists every device where you are signed in, and signs any of them out.
Report a problem
Found a security problem? Email kodeth.app@gmail.com with the steps to reproduce it. Do not open a public issue. We reply within three working days.