Terms of service

Vora reviews pull requests for security defects and reports what it finds inline, on the lines concerned. It is advisory. Your team keeps the merge decision, and Vora never merges.

What it writes is a check run and comments on the pull request. It does not push commits, open pull requests, modify repository contents, or merge.

Whoever connects Vora needs the authority to do so on behalf of the organisation that owns the repositories, and the right to grant access to the code in them. Connecting it asserts that both are true.

• The accounts, scopes and installations you grant Vora are yours to manage, and yours to revoke.
• Findings are input to your judgement, not instructions. Read them before acting on them.
• A proposed fix is a diff you read in Vora and apply yourself. Vora does not apply it and does not send it to your repository.

In Microsoft Teams, Vora answers questions about findings that already exist and performs no write actions — it cannot start a scan, and it cannot change the status of a finding. In Slack it answers the same kind of question, and keeps no copy of the conversation.

A review reduces the chance that a defect reaches production. It does not establish that code is free of defects, and no tool of this kind can. Responsibility for the security of what you ship stays with you.

Your repositories and their contents remain yours. These terms grant Vora no rights in them beyond the access a review requires, and that access is read-only: Vora never writes to the contents of your repository.

• Do not connect code you have no right to grant access to.
• Do not use Vora to probe or attack systems that are not yours.
• Do not attempt to disrupt the service or to work around its limits.

Vora is offered as a pilot programme. No uptime commitment attaches to it, and the service may change while the pilot runs.

An organisation can disconnect Vora at any time — from GitHub, from Slack or from Teams — and that withdraws the access described on the privacy page immediately.

The date at the top of this page changes when their substance does.

Questions about these terms go to contact@chrom.ar.