Site navigation and actions.
Hydrofoil reviews real applications without giving an AI unrestricted access to your code, your credentials or your infrastructure.
Hydrofoil reads your code and writes only comments and checks. It cannot change your code.
| Permission | Level | Why |
|---|---|---|
| Metadata | Read | Basic repository information |
| Contents | Read | Read the diff and repo instructions |
| Pull requests | Read & write | Post the summary and inline review comments |
| Issues | Read | Read linked GitHub issues |
| Checks | Read & write | Report results as a check |
| Deployments | Read | Find the preview deployment |
| Commit statuses | Read | Find the preview URL when it's reported there |
| Organisation members | Read(optional) | Match PR authors to Hydrofoil users |
Test credentials and secrets are encrypted with AES-256-GCM envelope encryption. Each organisation has its own data key, protected by an AWS KMS key. Values are write-only: once saved, they're never shown again. Every create, update, delete and use is recorded in an audit log.
When the agent logs in, it uses a reference such as{{persona.admin.password}}. A separate layer swaps in the real value inside the sandbox, so the secret never reaches the AI model.
{{persona.admin.password}}Sees the reference only
Swaps in the real value
All browser traffic goes through an egress proxy that only allows the domains you've configured. Internal, loopback and cloud-metadata addresses are blocked, and previews must use HTTPS.
Text from pull requests, tickets and web pages is treated as untrusted data, never as instructions. The agent has a narrow toolset with no general web-request tool. Navigation is limited to an allowlist, and results are calculated by our code from the findings, not taken from the model's say-so.
For each repository you can list forbidden actions in plain English and block specific requests. We recommend previews that use seeded or sandbox data.
Known secret values are replaced with ••••in logs, step records, transcripts and findings. Password fields stay masked in screenshots. Transcripts are stored redacted.
Every query is scoped to your organisation. Screenshots, videos and traces are served only through short-lived signed links after an access check.
Artifacts are kept for[TBD: 30 days by default, plan-dependent]. Deleting an organisation purges secrets immediately and removes artifacts on the retention schedule.
Hydrofoil runs on AWS ([TBD: region]). Subprocessors: AWS (hosting, storage, email, key management and AI models via Amazon Bedrock), Stripe (payments), GitHub, and Jira if you connect it.
[TBD: AWS statement on how Bedrock handles customer data. Use their documentation's wording.]
[TBD: certifications held, or "We don't hold any compliance certifications yet."][TBD: security questionnaire available on request]
[TBD: security contact and disclosure policy]