DEVELOPER ACCESS

Only what publishing needs.

GitHub sign-in and repository access

The enzim Apps GitHub App connects repositories you explicitly select. Repository contents, workflows and pull-request write access let it prepare the managed build workflow and agent guide; you confirm the exact setup change before it is merged. Actions access starts and checks builds; attestation access verifies their provenance. The App does not request Secrets access or collect your app-specific build credentials. Choose only repositories you want to publish. The dashboard shows public repositories you own or maintain.

We use your GitHub numeric account ID and username to associate submissions with you, and check repository access again when you select or submit a release. We resolve the selected release to an exact source commit for review. We do not request your GitHub password or private email address.

Session storage

Your GitHub access token is stored encrypted on the server for a session of at most eight hours. It is never sent to browser JavaScript or saved in browser local storage. A Secure, HttpOnly, SameSite cookie identifies the session. Signing out removes the local session. You can revoke the app’s authorisation or repository access in your GitHub settings.

App settings and coding agents

You or your coding agent configure optional build values directly in your own repository’s ENZIM_BUILD_CONFIG Actions secret. Your own GitHub build receives these values; the store and attestation worker receive no app settings. Values embedded in a distributed app can be extracted. The build record discloses setting names, never their values.

You can issue a short-lived coding-agent token limited to one repository. It expires with your browser session, at most eight hours, and cannot change review decisions. Signing out invalidates these tokens. The store uses a protected GitHub App key for background build monitoring; this is separate from package signing.

What becomes public

When you submit, your listing, GitHub username, selected public repository and release, screenshots, icon and reviewer feedback become part of the public review record. Do not include passwords, private documents or sensitive personal information. Uploaded images are re-encoded to remove embedded metadata. Unsubmitted images stay accessible only to their uploader and reviewers, and are eligible for cleanup after 24 hours.

Submitted release history is retained for review and provenance. Contact the reviewer through the public submission repository for corrections or withdrawal; report sensitive security issues using its private Security reporting route.

Separate from releases

The developer service cannot sign packages, change the delivery server’s app allowlist or publish app updates. An approved build must pass testing and the private signed release process. Your app’s own privacy policy is separate from this developer-session explanation.

Developer API access logs omit query strings, OAuth codes, cookies and request bodies. This site does not add third-party analytics. GitHub operates the sign-in and repository APIs under its own policies.