Security and data access
Everything Abbox can reach in your systems, what it does there and why, in plain terms. Abbox never writes to your backend or database, and code changes only ever arrive as pull requests on new branches.
Last updated 2026-11-10. Also available as JSON for automated review.
At a glance
| Source | Reads | Writes |
|---|---|---|
| GitHub | Code of repositories you choose | New abbox/ branches and pull requests, only on request |
| PostHog | Totals for one project | Nothing |
| Your website | Only inside the Abbox viewer: the page, selected elements, a minute of activity | Temporary styles and mocked previews, in that browser tab |
| Your coding agents | Summaries of your projects, with a token you create | Nothing |
| Backend and database | Nothing | Nothing |
GitHub, through the Abbox Connect app
You install the Abbox Connect GitHub App on your account or organization and choose the repositories it may use.
Permissions
- Metadata: read
- Contents: read and write
- Pull requests: read and write
- Webhook events: push, installation_repositories
Reads
- The code of the repositories you select, at each commit Abbox analyzes
- Push events, so every push to the connected branch is analyzed
Writes
- Only when someone in your workspace asks: Fix it, a design change, or Add the inspector
- Commits only to a new branch whose name starts with abbox/ (abbox/fix-…, abbox/inspector-install-…), then opens a pull request from it
Never
- Push to an existing branch, including main
- Merge, close or approve pull requests
- Change repository settings, secrets, issues or workflows
Why: Write access to contents is how GitHub lets an app create a branch with commits. Pull request access lets it open the pull request your engineers review.
Remove access: Uninstall Abbox Connect, or remove repositories from it, in GitHub settings → Applications (organizations: Settings → GitHub Apps). Protecting main with required reviews makes merging without review impossible for anyone.
PostHog (optional)
You sign in to PostHog with OAuth on your project page and choose one PostHog project.
Permissions
- query:read
- project:read
Reads
- Totals for the last 60 days: event and page-view counts per page path, how they change over time, which pages visitors move between
- Device type, referring domain and country counts behind page views
- Exception types with the first 160 characters of their messages
Never
- Session recordings
- Person profiles, emails or any individual visitor's events
- Changes to your PostHog project
Why: So the viewer's Tracking tab shows real usage on the buttons and pages it belongs to.
Remove access: Disconnect on the project page: Abbox deletes the tokens and asks PostHog to revoke them. Deleting the project or account does the same.
The Abbox inspector on your website (optional)
You add the open npm package @abbox/inspector with `npx @abbox/cli init`, review the changes and deploy them. It is pinned to an exact version.
Permissions
- Your site can be shown in a frame by https://viewer.abbox.com, https://abbox.com and https://www.abbox.com (Content-Security-Policy frame-ancestors). Builds made with ABBOX_INSPECTOR=0 add nothing
- In production builds the inspector only accepts messages from the Abbox viewer origin it was built with
Reads
- Only while your site is open inside the Abbox viewer, in that browser tab: the page address and title
- The element someone selects: its tag, up to 160 characters of its text, and its source file and line
- The last minute of activity in that tab: clicks, pages visited, form submissions, errors and requests (method, address without its query string, status, timing), sent only when someone reports a bug
Writes
- Highlights elements and applies temporary styles inside the viewer
- To preview a hidden state (a modal, an error), replays clicks and answers your API's requests with mocked responses, while blocking every request that would change data (non-GET fetch and XHR, form posts, beacons)
Never
- Run for your visitors: outside the Abbox viewer it only waits for a message from the viewer and does nothing else
- Make network requests of its own or contact Abbox's servers
- Read what is typed into fields, passwords, cookies, or request and response bodies
Why: It lets the viewer link what you see on your real site to the code behind it, and preview states that only appear after clicks.
Remove access: Run `npx @abbox/cli@latest uninstall` in the app folder, commit and deploy: it removes everything init added and keeps your own edits. Or build with ABBOX_INSPECTOR=0. Known limits: the page address sent to the viewer currently includes its query string, and WebSocket messages are not blocked during previews.
Your coding agents (optional)
Someone in your workspace creates an access token on the Connect your coding agent page and adds it to Claude Code, Cursor or VS Code. Tokens are read-only, belong to one workspace, and can be revoked there at any time.
Permissions
- Read this workspace's projects through Abbox's MCP server (https://api.abbox.com/mcp)
- Nothing else: a token can't call any other part of Abbox
Reads
- What Abbox already shows you: each page's code map, PostHog totals, Google PageSpeed results, search checks and recent changes, as short summaries
Never
- Change anything in Abbox, GitHub, PostHog or your website
- Reach another workspace's projects
- Keep the token itself: Abbox stores only a one-way hash of it
Why: So a coding agent can check a page before changing it, and check a deploy after, with the same facts your team sees in the viewer.
Remove access: Revoke the token on the Connect your coding agent page. Deleting the account removes every token.
What Abbox stores
| What | Where | Kept |
|---|---|---|
| Account: email address and a hash of your password | Database (Supabase) | Until you delete your account |
| Projects, repository connections, analysis and comparison records | Database (Supabase) | Until you delete the project or account |
| Analyses of your code (pages, components, texts, analytics calls) and AI descriptions of them | File storage (Amazon S3, Frankfurt) | Until you delete the project or account |
| Conversations, bug reports, fix records and page speed results | Database (Supabase) | Until you delete the project or account |
| PostHog tokens, encrypted; the totals read from PostHog | Database; totals in server memory | Tokens until you disconnect; totals for 10 minutes |
| Viewer sessions | Database | Expire after 30 minutes; sign-in links after 5 minutes |
| Agent access tokens: a one-way hash, a name and when each was last used | Database (Supabase) | Until revoked, or the account is deleted |
Sign-in and viewer links are single-use. Tokens are kept hashed or encrypted. All traffic uses HTTPS.
Who processes it
- Amazon Web Services, in the EU: API servers and file storage in Frankfurt, and AI models through Amazon Bedrock, which processes prompts only in AWS EU regions. Your code is not used to train models.
- Supabase: database.
- Vercel and Cloudflare: host and deliver abbox.com and the viewer.
- GitHub and PostHog: only the access you grant above.
Settings and environment variables
Nothing needs secrets on your side except an agent’s access token. These settings change what Abbox does:
| Setting | Where | What it does |
|---|---|---|
ABBOX_TOKEN | Your shell, for the Claude Code plugin | The read-only access token (abx_…) the plugin sends to Abbox's MCP server. |
ABBOX_INSPECTOR=0 | Your build (Dockerfile, CI) | Builds without the inspector, even in production mode. |
ABBBOX_INSPECTION_MODE=production | Set by npm run build in production mode | Includes the inspector in a live build. Spelled with three Bs. |
ABBBOX_INSPECTOR=1 | Set by npm run dev:abbox | Includes the inspector in local development. |
Reporting a vulnerability
Email kamran.elchuzade@abbox.com with what you found and how to reproduce it. We reply within 2 working days, keep you updated until it’s fixed, and credit you if you’d like. Please don’t access other people’s data or disrupt the service while testing. Also at /.well-known/security.txt.
Deleting your data
- Delete project, at the bottom of a project page: removes the project's records, analyses, AI descriptions, conversations, its PostHog connection (revoked at PostHog) and its stored files.
- Delete account, on the Account page: does the same for every project, then removes your workspace, repository connections, agent tokens, sessions and sign-in.
- Neither changes your code or GitHub: run `npx @abbox/cli@latest uninstall` in your web app to remove everything init added, and uninstall Abbox Connect on GitHub.
Questions or a security report: contact us. Full details are in the privacy policy.