How to Give Us Access Safely

Last updated: 2026-10-14

Option A: GitHub collaborator (recommended)

Invite us as a collaborator on your GitHub repo. We only need write access to open a pull request. You can also fork your repo and give us access to the fork instead.

Go to your repo → Settings → Collaborators → Add people → invite fixloop-bot (or the email we give you).

Option B: Send a zip

If you'd rather not give repo access, you can send us a zip of your codebase. We'll send back a patch file or detailed instructions.

Never send us these by email

Supabase service_role key
Production database credentials
Stripe secret keys
Any other production secrets

If we need to test something that requires secrets, we'll ask you to set up a staging environment or run the test yourself.

Database changes

If your fix needs database changes (like RLS policies or schema updates), we give you the SQL to run yourself. We don't ask for direct database access.

We never push to main

We open a pull request to a feature branch. You review it and merge it yourself. We never push directly to your main or production branch.

After the fix

Revoke our access: Remove us as a collaborator once you've merged the PR
We delete clones: All repo clones and working copies are deleted within 7 days

Free security scan

The free scan only needs your public app URL. We don't need repo access for it. We check whether your Supabase tables are readable without login and whether API keys are exposed in your frontend.

Questions?

Email fixloop@mail.grokbot.com if you have concerns about access or security.