GitHub permissions
Publish and update the stable ProofLock Check Run.
Read the policy from the base commit and inspect repository files required for evaluation.
Read changed files, current head state, and review evidence.
ProofLock does not request OAuth identity or device-flow access.
Events and evaluation
ProofLock receives signed pull_request, pull_request_review, and push webhooks. Signatures are verified before payloads enter the evaluation queue.
Repository policy is loaded from the pull request's base commit. Immediately before publishing a result, ProofLock refreshes the authoritative pull request head so delayed events cannot approve stale code.
Token handling
Installation tokens are narrowed to the event repository and the three permissions above. Tokens are held in installation-scoped Durable Object memory and refreshed before expiry. Private keys and webhook secrets are stored as Cloudflare Worker secrets.
Fail-closed behavior
Invalid policy, incomplete file enumeration, unsafe repository paths, lost evaluation leases, and exhausted retries never become a passing decision. Recoverable failures are retried; exhausted work is retained for operator recovery.
Report a security issue
Please do not disclose suspected vulnerabilities publicly. Email info@haya.company with reproduction details and the affected repository or installation.