Privacy
What opensrcer stores, where it goes, and how long it is kept. Last updated October 7, 2026.
Signing in
You sign in with GitHub through Auth0. opensrcer asks GitHub for access to public repositories (to fork them and open draft pull requests), your profile and email (to identify your account and attribute commits), and organization membership (to check administrator access when you connect an organization). Your GitHub token stays inside the encrypted sign-in session; it is not written to opensrcer's storage.
Your AI provider keys
Anthropic and Gemini keys you add in Settings are kept only in an encrypted, HTTP-only cookie in your browser, bound to your account. The cookie expires after 30 days and is deleted when you sign out. A key is sent only to the provider it belongs to, and to the isolated worker that runs a job you start.
Runs, logs and code graphs
When you start a run, the issue and the relevant repository source are sent to the AI provider you configured, using your key. Run records, logs and code graphs are stored privately and scoped to your account; logs can contain repository content but never credential values. Your newest 100 runs and 20 code graphs are kept and older ones are removed automatically. Each job runs in a disposable virtual machine that is stopped when the job ends.
Pull requests and shared fixes
Draft pull requests are created on GitHub under your account, and only by runs you start in live mode; preview runs never open one. A shared fix link is unlisted and anyone with the link can view it; it stops working 30 days after it is created.
Services we rely on
Vercel (hosting, private storage and isolated workers), Auth0 (sign-in), GitHub (repositories and pull requests), and Anthropic or Google Gemini when you use them with your own key. opensrcer has no advertising and no analytics or tracking scripts.
Revoking access and deleting data
Settings → “Disconnect all & sign out” stops your active runs, disconnects your organizations, clears your saved keys and signs you out. It does not delete past run history or code graphs. You can also revoke opensrcer's GitHub access at any time from GitHub's application settings. To have your stored runs and graphs deleted, contact the maintainer through the opensrcer repository.