L1 · GitHub
We never write your code
The App only reads archives and posts Checks. It cannot push commits or inject scripts into your deploy.
01 Security
Trust is the product surface.
If a security tool asks for write access to your code, or executes PR head as part of analysis, it has already expanded the blast radius. Norekt is built the other way.
Source is data
Archives and checkouts are read as trees. We do not run, build, or import your application code inside the analyzer.
Engine outside the tree
On the Action path, the engine installs outside github.workspace. Never drop a self-scan copy under the repo as .norekt.
Base owns policy
.web3shield.yml loads from the PR base. Attackers on a feature branch cannot turn off scanners via config alone.
Fail closed on config
Broken or unreadable configuration is a hard error—not a silent green check.
Secrets never echoed
Findings report type, path, and line. Values are not printed in Checks or annotations.
Minimum permissions
Hosted App: Contents R, Pull requests R, Checks RW, Metadata R. No Contents write. No admin.
02 Layers & trust
GitHub App ≠ L2 pre-sign sheet
Easy mix-up: “no write permissions” is about the GitHub App. Runtime UI is a different boundary.
L2 · Partner dApp
They install the SDK
Pre-sign sheets ship in the partner’s frontend bundle (@norekt/sdk) — like adding analytics. We do not remote-inject into sites we don’t own. Compromised page JS can still strip the SDK; full CDN integrity is L3.
03 Permissions
What we ask GitHub for
| Permission | Level | Why |
|---|---|---|
| Contents | Read | Fetch PR head/base archives as data |
| Pull requests | Read | PR metadata and event context |
| Checks | Read & write | Create and update the Norekt Check and annotations |
| Metadata | Read | Required GitHub App baseline |
| Contents write | Never | We do not push, edit, or merge your code |
04 Modes
Shadow first. Enforce when you mean it.
Shadow
Default for pilots
Findings on the Check. Non-enforced scanners do not fail the job. Use this for precision dogfood.
Enforce
Opt-in per check
Scanners with enforce: true fail the Check. High-confidence secrets often enforce even while mode is shadow.
05 Claims
What we will and won’t say
We will say: Norekt finds high-value frontend and supply-chain issues on PRs; dual delivery (App + Action); L2 pre-sign is a partner-installed SDK (dogfood); L3 CDN/DNS is a pilot with operator baselines.
We will not say: that L1 or L2 alone stops Bybit-class incidents; that we inject UI into partner sites without their integration; that pilot L3 is a full production SOC; that precision is Marketplace-ready until evidence gates say so.
Report vulnerabilities: SECURITY.md