Trust
Is AppTruth read-only?
Yes. AppTruth uses read-only GitHub repository access and cannot change, push, or delete application code.
Reviewed by Uriel from AppTruth · Updated · 3 min read
Direct answer to “Is AppTruth read-only?”
Yes. AppTruth’s repository scan access is read-only. It can read approved repository code and metadata, but it cannot push commits, edit files, change repository settings, or delete code.
Key points: Is AppTruth read-only?
- Repository access is granted through a GitHub App.
- The user controls which repositories are approved.
- A scan analyzes source and produces findings; it does not modify the app.
What read-only means in AppTruth
Read-only access means AppTruth retrieves the source and metadata required to prepare a repository review. It does not request a write workflow as part of scanning and does not commit the suggested fixes it produces.
A remediation prompt is guidance, not an automatic change. The user decides whether to send that prompt to a developer or coding agent, edit the requirement, or leave the existing behavior unchanged.
Does AppTruth change live data?
No. A repository scan does not submit forms against the deployed app or make calls intended to mutate a live database, payment account, authentication tenant, email provider, or cloud environment. It analyzes implementation from the approved source snapshot.
How users control access
During GitHub installation, the account owner selects the repositories AppTruth may access. GitHub remains the place to review, narrow, suspend, or revoke that installation. Following least-privilege practice, users should approve only the repositories they intend to scan.
What read-only repository access permits and prevents
| Action | AppTruth scan | User control |
|---|---|---|
| Read approved source | Allowed | Choose repositories in GitHub |
| Read basic repository metadata | Allowed | Review app permissions |
| Push or edit code | Not allowed | No write permission granted |
| Change settings or delete code | Not allowed | Revoke installation at any time |
The READ-ONLY Check
A least-privilege review users can perform before approving a repository integration.
- Review permissions: Confirm the integration requests only the repository access it needs.
- Approve narrowly: Select only repositories intended for analysis.
- Distinguish guidance: Treat remediation prompts as suggestions, not automatic writes.
- Revoke when needed: Use GitHub installation settings to suspend or remove access.
Trusted sources that inform this guide
These independent sources support the surrounding verification practices. AppTruth-specific product statements are product guidance and should be confirmed against current account or contractual documentation when formal assurance is required.
- Choosing permissions for a GitHub App — GitHub Docs. Explains how GitHub App permissions should be selected and limited to the access an integration needs.
- Secure Software Development Framework (SSDF) — NIST. Defines outcome-based secure software development practices, including verification and release preparation.
Related questions about “Is AppTruth read-only?”
Can AppTruth push a remediation commit?
No. It can produce an implementation-ready prompt, but it cannot push, edit, or delete repository code.
Does read-only repository access mean no data is stored?
No. Read-only describes what the integration can do to the repository. Scan processing and retention are separate data-practice questions.