Security and safety

What the App is

btcdecoded-intelligence posts cited review comments and a neutral check on installed repositories. It does not approve, reject, or merge. Humans keep merge authority. MCP analyze_pr / analyze_issue stay on public GitHub URLs. Private review is the App webhook path only.

Risk management

The App is inert until the installer GitHub login matches the signed-in account and that account has an unexpired Developer plan. Each armed run costs query quota. Unarmed or over cap: no issue comment. Checks, when written, are conclusion neutral only. The bot skips other bots, skip drafts on open, and only answers the command token /btcdecoded. Writes use the installation token. Org installs arm the installer, not the org login.

Data governance

Private patches and issue bodies are live-only: not stored in the public index, Vectorize, or R2, and not logged. A private draft may be sent to Cloudflare Workers AI for that review. Webhooks are HMAC-verified on the raw body; a failed signature is rejected. Duplicate deliveries are ignored. Uninstall the App on GitHub to stop new reads. Detail: Privacy and Third-party services.

Human oversight

Comments are suggestions with citations. They are not a required merge gate. A person still reviews and merges. The App never posts a merge verdict.

EU AI Act

This is a developer-tooling assistant. It is not an Annex III high-risk system under Article 6 (not biometrics, employment, essential private or public services, law enforcement, or the other listed high-risk areas). Articles 8–17 therefore are not claimed as a high-risk conformity set. Transparency: GitHub shows the App as a bot; comments are clearly from the App; a human remains in the merge loop.

Compliance and reports

No SOC 2, ISO/IEC 27001, GDPR certification, or EU AI Act conformity-assessment reports are published. There is no third-party audit PDF to link. Practices on this page are product controls, not a certification.

Listing on GitHub Marketplace is under the GitHub Marketplace Developer Agreement. Product terms: Terms. Security reports: security@thebitcoincommons.org. Support: Support.