Security Model

Core Principle

RepoMetro never reads or includes file contents. It only analyzes metadata:

• File names and paths
• File sizes
• Line counts (for text files only)
• Language detection (by file extension)
• Dependency counts (from manifest file names, not contents)
• Git history (commit messages, authors, dates — from git log)

Sensitive File Filtering

The security analyzer detects and excludes these patterns from output:

Pattern	Match	Example
.env	Environment variable files	.env, .env.local, .env.production
.pem	PEM certificates/keys	server.pem, key.pem
.key	Private keys	private.key, ssh.key
id_rsa	SSH private keys	id_rsa, id_rsa.pub (excluded)
credentials	Credential files	credentials.json, aws-credentials
.p12	PKCS12 certificates	cert.p12
.pfx	PFX certificates	cert.pfx

What RepoMetro Does NOT Do

• Does not read file contents — ever
• Does not send data to external services
• Does not make network requests
• Does not require API keys or tokens (beyond the auto-provided GITHUB_TOKEN)
• Does not execute repository code
• Does not upload data anywhere except GitHub Actions artifacts

GitHub Token Usage

The Action uses the auto-provided GITHUB_TOKEN only for:

• Posting PR comments (requires pull-requests: write permission)

No other API calls are made. The token is never logged or stored.

Permissions

The Action requires minimal permissions:

permissions:
  contents: read        # Read repository files
  pull-requests: write  # Post PR comments (only if pr-comment is enabled)

If PR comments are disabled (pr-comment: false), only contents: read is needed.