A trust product has to be trustworthy first.
StackAttest exists to help you prove your software is sound, so the way we handle your source and your evidence has to hold up to the same scrutiny. Here is how it works.
Your source stays yours
A validation reads your code with a read-only connection. StackAttest never publishes it, never sells it, and never hands it to a third party. When you share a Passport, the reader sees the result, never the source behind it.
The AI panel never sees raw source
Our independent reviewers judge structured evidence, not your files. What leaves for a model is a small, reviewed class of metadata, and in production that egress is gated by policy. Bring your own model key and it bills to your provider, not through ours.
You control every share
A Passport is shared section by section, with the sections you choose. Access can carry an expiry, and you can revoke it at any moment. Nothing is public until you say so.
Tenant isolation is enforced in the database
Every customer's data is separated with row-level security in Postgres, not just in application code. A request can only ever see the workspace it belongs to.
Fixes are never silent
When StackAttest proposes a fix, it opens a reviewable pull request. Nothing is merged, and nothing touches your production systems, without your explicit approval.
Signed, checkable attestations
A public Passport can carry a signed attestation. Anyone can verify the signature against our published key, without an account and without seeing any evidence.
Have a security question or want to report an issue? Write to us at [email protected] and a person will respond.