Frequently asked questions

When a pull request opens, your code-hosting platform (GitHub, GitLab, or Bitbucket) sends a signed webhook to SiftPulse. We verify the signature, fetch the unified diff and PR metadata, and strip content matching known secret patterns (private keys, .env assignments, credential regexes) before assembling the review prompt. The cleaned prompt is sent through the Polsia-managed AI proxy (POLSIA_AI_BASE_URL) — see Security & data for the full sub-processor breakdown. Findings are formatted into a PR review comment and posted back to your PR using the installation token. Each review is logged in pr_review_events with verdict, blocker/suggestion/nit counts, and a summary excerpt so it shows up in your dashboard, activity feed, and DORA metrics.

The SiftPulse GitHub App requests a narrow, read-mostly set of permissions:

• Read metadata — PR titles, numbers, authors, branch names, file paths changed.
• Read code / pull requests — unified diff contents for files changed in the PR.
• Read + write issues — for triage labels and triage comments.
• Write pull requests — review comments only.
• Read members — organizations only; reviewer-suggestion feature only.

SiftPulse does not request write access to source code, cannot push commits, and has no ability to merge, close, or delete PRs. It cannot manage members, deploy keys, or repository settings. The full permission table lives at /security.

Go to GitHub Settings → Applications (or the equivalent in your GitLab workspace / Bitbucket workspace) and uninstall the SiftPulse integration. Removal stops new webhooks immediately — SiftPulse will not see any further events for that installation. Review event rows already in our database are purged within 30 days, and you can request immediate deletion by emailing privacy@siftpulse.polsia.app.

Three tiers are available today: Free (public OSS repos only, via the GitHub Marketplace), Starter, and Team. Starter and Team add private-repo support, prioritize paid reviews in the queue, and unlock the dashboard. Team adds Slack notifications plus unlimited repos. Detailed pricing, FAQ on each tier, and a comparison table live at /pricing.

Drop a .siftpulse.yml file at the root of any reviewed repository to tune agent behavior per-repo. Supported keys include:

• tldr_comment — toggle the "🧭 SiftPulse TL;DR" sticky comment at the top of every PR.
• suggestions — opt in or out of one-click suggestion blocks for mechanical fixes.
• review_prompt — free-form custom instructions appended to the PR review system prompt.
• triage_prompt — free-form instructions for the issue triage agent.

You can also configure structured conventions (forbidden/required libraries, error-handling patterns, observability rules, severity overrides) via .siftpulse.yml or the dashboard's Custom agent instructions UI. Full schema and YAML/dashboard precedence rules are in the /docs/custom-prompts reference.

SiftPulse stores the outputs of each review — verdict, blocker/suggestion/nit classifications, summary excerpt, and comment ID — but not the raw diff or full repository source code. Diffs are processed in memory at review time, sent to the AI provider under its zero-retention terms, and then discarded. Other retained data includes GitHub App installation metadata, PR/issue titles + numbers + authors, your email + Stripe customer ID for billing, and dashboard usage telemetry (via Plausible + the Polsia beacon). Full enumeration with sub-processor breakdown lives at /security.

Yes. SiftPulse supports GitLab (via OAuth or Personal Access Token) and Bitbucket Cloud (via OAuth). PR review, issue triage, retroactive reviews, and TL;DR sticky comments all work the same way across all three platforms. See the GitLab setup guide or Bitbucket setup guide to get connected.

Yes — Starter and Team plans support both public and private repositories. The Free plan (via the GitHub Marketplace) is limited to public repositories only; private-repo coverage requires an active paid plan.