Security
Trust is the product.
You're handing us the code of the thing you built. These are the rules Tidy Giant is designed around.
Pull requests only
Every change lands on a tidy-giant/ branch and arrives as a pull request. Giant never pushes to your default branch and never merges for you.
You approve first
You see what was found, what will change, the risk, and the credit estimate before any cleanup starts.
Isolated by design
Your code is analyzed in a temporary sandbox made for that one job, with strict limits, and destroyed when the job ends. It never runs on our app servers.
Minimal GitHub access
Install on selected repositories only. Read access for scans, write access only to create cleanup branches and pull requests. No admin permissions, no access to your secrets.
Your secrets stay yours
We record the names of environment variables, never their values. Production secrets are not copied into analysis environments.
Repo text is data, not orders
Comments, docs and config inside a repository are treated as untrusted content. They cannot change what Giant is allowed to do.
Honest about certainty
Tidy Verified means the required checks actually ran and passed. We say what we could not verify, and we recommend manual review for sensitive changes.
Leave any time
Disconnect a repository and delete its stored analysis whenever you like. Undo any change with Git.
Tidy Giant is in private beta. This page describes how the product is designed to work. No tool can promise bug-free or perfectly secure software, and we won't pretend to.
Built it fast.
Now make it solid.
Connect a repo and see what the Giant finds. Scans never change your code.
