Privacy policy

What you send us

The address of the repository you want scanned. It is used to scan that public repository and is stored with the result (see below), never together with anything about you.

Like every website, your browser sends your IP address with each request. GiTRay uses it only to limit how many scans one visitor can start (6 a minute). The server holds it briefly in memory for this; the database never stores the address itself, only a keyed hash (HMAC) of it with a counter, and deletes these counters after about a day. Your IP address is not written to GiTRay's logs and is never sent to the services listed below.

Scan results are public

The latest scan of each repository is stored: the repository's name, description, star count, commit, verdict, score and the findings, with short excerpts of the repository's files. Anyone can see these results on the scan page and in the public lists (Recent scans, Safe Zone, Dangerous). Nothing about who started a scan is stored with it. At most 5,000 results are kept; the oldest are deleted first.

Cookies and browser storage

GiTRay sets no advertising cookies, and analytics cookies only with your permission (see the next section). Besides that there are small preferences, saved only when you choose them yourself:

gitray-lang: the language you picked in the language menu, so the site opens in it next time (one year).

gitray-theme: the theme you picked (light or dark). It stays in your browser's local storage and is never sent to the server. Choosing System removes it.

gitray-consent: your answer to the analytics question, kept in your browser's local storage so the question is not asked again. It is never sent to the server.

Google Analytics, only with your permission

On your first visit the site asks whether it may use Google Analytics. Until you answer, and if you reject, nothing from Google is loaded and nothing is sent to Google.

If you accept, the site loads Google Analytics, provided by Google, to count visits and see which pages are used. Google sets its cookies (_ga, _ga_*) and receives your IP address, your browser and device details, the pages you view (including which scan pages) and the site that sent you. Google may process this data outside Türkiye and the EU, including in the United States, under its own policy (Google). GiTRay only sees totals in the Google Analytics dashboard, not who you are.

You can change your answer at any time with Cookie settings at the bottom of every page. Withdrawing it deletes the Google cookies on this site and stops Google Analytics.

Services that take part in a scan

During a scan GiTRay's server contacts the following services. They receive information about the scanned repository, never about you:

GitHub: the repository's details and files are read from GitHub's API and download servers.

OSV (osv.dev): the names and versions of the packages the repository depends on, to look for known malicious packages.

VirusTotal: only SHA-256 fingerprints of programs and release files. No file is uploaded.

Links to GitHub and VirusTotal on a report take you to those sites, where their own privacy policies apply.

Hosting

The site runs on a server operated by the site's owner, and scan results and the rate-limit counters are kept in a Postgres database at Neon. The server may keep standard request logs, which include IP addresses. Fonts are served from this site. The only third-party script is Google Analytics, and only after you accept it.

Reporting a wrong result

If you use the "report a wrong result" button on a scan page, GiTRay stores the note you write together with that scan's repository, verdict, score and engine version. No name, email or other identity is asked for or stored. Your IP address is used only to limit how often reports can be sent and to curb abuse, and is kept only as a keyed hash (HMAC), never in full.

These reports are private: only the site owner reviews them, to improve the detection. They are not shown publicly. At most 2,000 are kept; the oldest are deleted first.

The owner signs in to review them on a private page, with a username, a password and a robot check; the sign-in IP address is used only, as a keyed hash, to limit failed attempts.

Changes

If this policy changes, the date at the top changes with it.