Enterprise Security, Privacy & Governance

CodeJackRabbit is designed for security-conscious engineering organizations. Our architecture is built around a simple rule: local review stays local unless you choose a connected workflow, and connected workflows never train on your proprietary code.

1. Data Privacy & Zero Model Training

• Zero training on customer code: Your source code, diffs, and internal conventions are never used to train foundation models.
• Automatic secret redaction: Detected credentials, tokens, and high-entropy secrets are masked immediately and never echoed back in pull-request comments or logs.
• Ephemeral diff processing: In connected cloud reviews, diffs are analyzed in isolated sandboxes solely to produce findings and patches.

2. Three Deployment Modes for Your Security Perimeter

• Local Workstation (cjr review --local): Reads selected Git changes directly on the developer's machine with zero network calls and no account required.
• Managed Organization Cloud: Automated webhook reviews for GitHub, GitLab, Bitbucket, and Azure DevOps with organization-level access controls (RBAC) and encrypted transport.
• Bring Your Own Key (BYOK) & Private VPC: Connect CodeJackRabbit directly to your organization's existing LLM endpoints (Azure OpenAI, AWS Bedrock, Anthropic, Google Vertex/Gemini, or self-hosted Ollama/vLLM) so code context stays under your enterprise provider agreements.

3. Regulatory Compliance Gates & Attestation

• SOC2, PCI-DSS & HIPAA Merge Gates: Enforce policy-as-code gates before merge, producing a cryptographic SHA-256 attestation receipt for every release.
• OASIS SARIF 2.1.0 Integration: Export CWE and OWASP Top-10 mapped security findings directly into GitHub Code Scanning and GitLab Security Dashboards.
• Supply-Chain & CycloneDX 1.5 SBOM: Detect package typosquatting, AI-hallucinated dependencies (slopsquatting), and restricted SPDX licenses on every PR.

4. Credential Hygiene & Vulnerability Disclosure

• Repository configuration (.codejackrabbit.yaml) never stores API keys; credentials stay in your server or environment secrets.
• Treat CLI connection keys like passwords; keys can be rotated or revoked immediately from your organization account.

To request our enterprise security overview or report a vulnerability, contact security@codejackrabbit.com or visit Support. Review our Privacy Policy and Terms of Service for data retention and governance details.