# What LibWatch reads, keeps and does in your repositories.

Source: https://libwatch.com/en/security

Security and data

You're giving us access to your repositories. Here is, plainly, what LibWatch does with it: what it reads, what it keeps, the permissions it asks for and how to take them back.

## At a glance

ReadsYour dependency files, through the API

KeepsThe list of packages and their versions

RunsNothing. No code from the repository is run

ClonesNever: no repository is copied to our servers

Hosted in France by OVHcloud

How an analysis works

## Four steps, in order

What happens between the moment you connect a repository and the alert you receive.

1. 1 · Reading

2. 2 · No copy

3. 3 · Matching

4. 4 · Nightly check

## Files read

The complete list of what LibWatch requests from the API. Nothing else is read.

- `composer.json`
- `composer.lock`
- `package.json`
- `package-lock.json`
- `yarn.lock`
- `pnpm-lock.yaml`
- `Gemfile`
- `Gemfile.lock`
- `*.gemspec`
- `requirements.txt`
- `Pipfile`
- `Pipfile.lock`
- `pyproject.toml`
- `poetry.lock`
- `runtime.txt`
- `go.mod`
- `go.sum`
- `Cargo.toml`
- `Cargo.lock`
- `rust-toolchain(.toml)`
- `pom.xml`
- `build.gradle(.kts)`
- `settings.gradle(.kts)`
- `*.versions.toml`
- `gradle.lockfile`
- `gradle.properties`
- `gradle-wrapper.properties`
- `buildSrc/*.kt`
- `*.csproj`
- `*.fsproj`
- `*.vbproj`
- `Directory.Packages.props`
- `Directory.Build.props`
- `packages.lock.json`
- `global.json`
- `Podfile`
- `Podfile.lock`
- `Package.swift`
- `Package.resolved`
- `project.pbxproj`
- `pubspec.yaml`
- `pubspec.lock`
- `.nvmrc`
- `.node-version`
- `.ruby-version`
- `.python-version`
- `.java-version`
- `.swift-version`
- `.sdkmanrc`
- `.tool-versions`
- `.mise.toml`
- `.npmrc`
- `nuget.config`

.npmrc and nuget.config are read only to detect your private registries, never their credentials.

Permissions requested

## The permissions LibWatch asks for, and what it does with them

Some permissions are broader than what we use them for. We'd rather tell you than hide it from you.

| Permission | Why this permission | What LibWatch does with it |
| --- | --- | --- |
| GitHub · repo | GitHub offers no read-only access to a private repository: this permission includes write access. | Read dependency files and create the webhook that reruns the analysis on every push. |
| GitLab · api | GitLab doesn't separate read access from webhooks. | Read files and create the webhooks. |
| GitLab personal access token | Created by LibWatch, valid for one year, so it doesn't depend on the login token, which expires. | The same uses. Revocable in GitLab › Preferences › Access tokens. |
| WordPress · application password | The only way to list plugins and themes through the REST API, with no plugin to install. | Read the versions of core, plugins, themes and PHP. Create a dedicated user. |

Hosting and subprocessors

## Where your data lives

-

Hosting

### OVHcloud, in France

The application and its database run on OVHcloud servers located in France.

-

Payment

### Stripe

Payments and billing go through Stripe. LibWatch never sees your card number.

-

Error tracking

### Sentry

The application's technical errors are sent there, without the contents of your repositories.

Take back control

## Revoke access in a minute

You can cut LibWatch off at any time, from your own tools.

1.

### On GitHub

Settings › Applications › Authorized OAuth Apps › LibWatch › Revoke.

2.

### On GitLab

Preferences › Applications: revoke LibWatch. Then Access tokens: revoke the LibWatch token.

3.

### On WordPress

Profile › Application Passwords: revoke the one for LibWatch.

4.

### In LibWatch

Deleting the project erases its inventory and its reports.

Frequently asked questions

## What CISOs ask

[Need a document for your CISO? Write to us →](mailto:bonjour@isee-u.fr)

### Does LibWatch copy my repository?

 No. LibWatch never clones a repository: it only reads your dependency files, one at a time, through the GitHub or GitLab API.

### Does my data leave France?

 The application and its database are hosted in France, by OVHcloud. Payments go through Stripe. The full list of subprocessors and their countries is on the [Subprocessors](/en/subprocessors) page.

### Can LibWatch push code without my approval?

 No. LibWatch reads your dependency files and pushes no commits to your repositories. The only thing it adds is the webhook that reruns the analysis on every push.

### Where can I find the full list of subprocessors?

 On the [Subprocessors](/en/subprocessors) page, with what each one processes and where.