Security Policy

Last updated: January 2026

1. Sandboxing & Isolation

All patch generation and code synthesis processes run in isolated, sandboxed environments. No production code is ever directly modified by our agent.

2. Secrets Management

Environment variables, API keys, and credentials are never parsed, stored, or transmitted within patch generation blocks. Our agent is designed to ignore secrets entirely.

3. Encryption

All data is encrypted in transit (TLS 1.2+) and at rest. We use industry-standard encryption protocols for all data storage.

4. Read-Only by Default

The favors.studio GitHub App operates with read-only repository permissions by default. Write access is strictly scoped and requested only when opening isolated Pull Request branches for detected patches.

5. Vulnerability Disclosure

We support responsible disclosure. Report security issues to owner@favors.studio. We will acknowledge receipt within 48 hours and work with you to address valid reports.

6. Compliance

We are committed to SOC2 compliance. Our security practices are designed to meet enterprise-grade standards.

favors.studio, operated by Wayne Thiel, Houston, TX, USA