Security & privacy

Honest controls for an MVP. We tell you what leaves your machine and what does not.

Private by default

PatchMesh never uploads your whole repository and never makes private code public by default.

Publishing to organisation or public scope requires a separate, explicit human confirmation an agent cannot supply.

Your source is not used to train models. Capsules are retrieved, not ingested for training.

Personal, organisation and public artifacts are stored under disjoint, content-addressed key spaces.

Every artifact is SHA-256 addressed and verified after retrieval; digest mismatches are rejected.

Source, commit, contributor and SPDX licence are preserved and shown before any download.

Regex + entropy scanning and redaction run before any remote transmission; secrets never leave or hit logs.

A no-remote-code mode lets only task text, metadata, versions, hashes and fingerprints leave the machine.

Before any GitHub/public request, a disclosure shows exactly what is sent; source, repo names and secrets are blocked by default.

GitHub results are commit-pinned, unverified candidates — never trusted until reviewed, scanned and tested.

Public imports enter a quarantine with licence/security/validation checks and explicit human approval before use.

README/code/comments from retrieved repos are treated as data, never as instructions to the PatchMesh agent (prompt-injection safe).

• Hashes, embeddings and structural fingerprints can reveal limited information and should be governed by organisation policy.
• Central validation of untrusted code is disabled by default; validation is client-reported for the deployed MVP. Run validation locally.
• Retrieved code is untrusted until you review and test it locally.
• This is engineering tooling, not legal advice; confirm licence obligations independently.