Security
Automation without giving up control.
Mantle operates inside a controlled workflow. Changes are generated in a disposable workspace, validated against your repository, and surfaced as pull requests for engineering review.
Controls on every run
- GitHub accessConnectedThrough a GitHub App, on only the repositories you choose, with the permissions listed below.
- WorkspaceDisposableCreated for one run, with none of Mantle’s own credentials, and deleted when the run ends.
- ValidationRequiredYour typecheck, lint, tests and build. A failing check stops the run before any pull request exists.
- Pull requestHuman reviewMantle opens it. Your team reviews it and merges it. Mantle never merges.
How Mantle is built
Built for the fact that it reads your source code.
- 01
Only the repositories you pick
Mantle is a GitHub App with the minimum permissions it needs. No passwords, no personal access tokens.
- 02
Disposable workspaces
Your code is checked out into a workspace built for one run, with a scrubbed environment and no Mantle credentials, and deleted afterwards.
- 03
Repository content is data
Comments and docs are never treated as instructions. Text aimed at the agent is ignored and flagged.
- 04
Edits must match exactly
Every change is checked against your real file. An edit that does not match is rejected, not guessed.
- 05
Signed, idempotent webhooks
Every GitHub and Stripe webhook is verified, and a duplicate delivery cannot open a second pull request.
- 06
Two-factor sign-in
Protect your account with an authenticator app. Recovery codes are stored only as hashes.
Permissions
Exactly what Mantle asks GitHub for.
How Mantle handles your data and code, including what it keeps after a run, is set out in the Privacy Policy.
| Permission | Access | Why |
|---|---|---|
| Contents | Read and write | Read code to analyze it, and push the migration branch. |
| Pull requests | Read and write | Open the pull request and see whether you merged it. |
| Metadata | Read | Required by GitHub for every app. |
| Email addresses | Read | Identify your account when you sign in. |