Originally published on the DevReview blog .

DevReview reads your pull requests. That means you are trusting us with code that isn't public yet. This post lays out what we do to deserve that trust, what outside scanners say about us, and what we have not finished.

This is our own write-up, not an audit. Scores are dated because they change.

What outside scanners say (measured 2026-10-24)

Qualys SSL Labs: A+ on one endpoint, A on the other. Our site is served from two edge addresses; we report both rather than the better one. Run the test yourself .

Mozilla HTTP Observatory: B (75), 11 of 12 checks passed. The one we lose points on is Content Security Policy. Our CSP currently runs in Report-Only mode: browsers report violations to us but do not block them yet. We are collecting reports first so that enforcing it doesn't break checkout or sign-in. We plan to switch to enforcement in early November 2026 and will update this post when we do. Run the test yourself .

Your code

We don't keep your code.…