Security and data

What LibWatch reads, keeps and does in your repositories.

You're giving us access to your repositories. Here is, plainly, what LibWatch does with it: what it reads, what it keeps, the permissions it asks for and how to take them back.

Read with an AI .md version

At a glance

Reads
Your dependency files, through the API
Keeps
The list of packages and their versions
Runs
Nothing. No code from the repository is run
Clones
Never: no repository is copied to our servers
Hosted in France by OVHcloud

How an analysis works

Four steps, in order

What happens between the moment you connect a repository and the alert you receive.

  1. 1 · Reading

    LibWatch reads your dependency files through the API

    It asks GitHub or GitLab only for manifests, lockfiles and language version files. No code is run, nothing is installed in your pipeline.

  2. 2 · No copy

    Your repository is never cloned

    LibWatch downloads only the files listed below, one at a time, through the API. It never clones your repository, and an automated test prevents a clone from coming back into its code.

  3. 3 · Matching

    The inventory is checked against vulnerability databases

    OSV (GitHub advisories included), CERT-FR for PHP, EPSS scores, the CISA KEV catalog and end-of-life schedules. This step no longer touches your repository.

  4. 4 · Nightly check

    Every night, the inventory is checked again

    Without reading the repository again: only the list already stored is compared with new vulnerabilities.

Files read

The complete list of what LibWatch requests from the API. Nothing else is read.

  • composer.json
  • composer.lock
  • package.json
  • package-lock.json
  • yarn.lock
  • pnpm-lock.yaml
  • Gemfile
  • Gemfile.lock
  • *.gemspec
  • requirements.txt
  • Pipfile
  • Pipfile.lock
  • pyproject.toml
  • poetry.lock
  • runtime.txt
  • go.mod
  • go.sum
  • Cargo.toml
  • Cargo.lock
  • rust-toolchain(.toml)
  • pom.xml
  • build.gradle(.kts)
  • settings.gradle(.kts)
  • *.versions.toml
  • gradle.lockfile
  • gradle.properties
  • gradle-wrapper.properties
  • buildSrc/*.kt
  • *.csproj
  • *.fsproj
  • *.vbproj
  • Directory.Packages.props
  • Directory.Build.props
  • packages.lock.json
  • global.json
  • Podfile
  • Podfile.lock
  • Package.swift
  • Package.resolved
  • project.pbxproj
  • pubspec.yaml
  • pubspec.lock
  • .nvmrc
  • .node-version
  • .ruby-version
  • .python-version
  • .java-version
  • .swift-version
  • .sdkmanrc
  • .tool-versions
  • .mise.toml
  • .npmrc
  • nuget.config

.npmrc and nuget.config are read only to detect your private registries, never their credentials.

Permissions requested

The permissions LibWatch asks for, and what it does with them

Some permissions are broader than what we use them for. We'd rather tell you than hide it from you.

PermissionWhy this permissionWhat LibWatch does with it
GitHub · repo GitHub offers no read-only access to a private repository: this permission includes write access. Read dependency files and create the webhook that reruns the analysis on every push.
GitLab · api GitLab doesn't separate read access from webhooks. Read files and create the webhooks.
GitLab personal access token Created by LibWatch, valid for one year, so it doesn't depend on the login token, which expires. The same uses. Revocable in GitLab › Preferences › Access tokens.
WordPress · application password The only way to list plugins and themes through the REST API, with no plugin to install. Read the versions of core, plugins, themes and PHP. Create a dedicated user.

Hosting and subprocessors

Where your data lives

  • Hosting

    OVHcloud, in France

    The application and its database run on OVHcloud servers located in France.

  • Payment

    Stripe

    Payments and billing go through Stripe. LibWatch never sees your card number.

  • Error tracking

    Sentry

    The application's technical errors are sent there, without the contents of your repositories.

Take back control

Revoke access in a minute

You can cut LibWatch off at any time, from your own tools.

  1. On GitHub

    Settings › Applications › Authorized OAuth Apps › LibWatch › Revoke.

  2. On GitLab

    Preferences › Applications: revoke LibWatch. Then Access tokens: revoke the LibWatch token.

  3. On WordPress

    Profile › Application Passwords: revoke the one for LibWatch.

  4. In LibWatch

    Deleting the project erases its inventory and its reports.

Frequently asked questions

What CISOs ask

Need a document for your CISO? Write to us →
Does LibWatch copy my repository?
No. LibWatch never clones a repository: it only reads your dependency files, one at a time, through the GitHub or GitLab API.
Does my data leave France?
The application and its database are hosted in France, by OVHcloud. Payments go through Stripe. The full list of subprocessors and their countries is on the Subprocessors page.
Can LibWatch push code without my approval?
No. LibWatch reads your dependency files and pushes no commits to your repositories. The only thing it adds is the webhook that reruns the analysis on every push.
Where can I find the full list of subprocessors?
On the Subprocessors page, with what each one processes and where.