ECC Tools

Security And Safety

• Webhook verification: GitHub and Marketplace webhooks are verified with HMAC signatures.
• GitHub App auth: ECC Tools uses JWT-based GitHub App authentication and installation-scoped access tokens.
• Internal route protection: Privileged internal API routes require a bearer secret and installation ownership checks.
• Least-persistent processing: Repository analysis is processed ephemerally in Cloudflare Workers; generated outputs are written back to the customer repository through pull requests and check-runs.
• Safe lifecycle planning: Setup, repair, and uninstall flows are driven by install manifests and owned-file maps to reduce destructive changes.

Data Handling

• Repository data: ECC Tools reads commit history, repository metadata, file trees, and limited file contents needed for analysis and audits.
• No permanent source archive: ECC Tools does not keep a long-term mirror of customer source code.
• Temporary cache: Analysis and usage state are cached for deduplication, rate limiting, and operational support.
• Billing data: GitHub Marketplace handles Marketplace billing. Stripe is used only for ECC-hosted billing flows where applicable.
• PII: ECC Tools stores only the minimal account and installation context needed to operate the app.

Third-Party Services

• GitHub API
• Anthropic Claude API
• Cloudflare Workers / KV / Queues
• Stripe

Intended Use And Limits

ECC Tools is for repository analysis, workflow extraction, skill generation, install planning, and configuration auditing inside repositories where the app is installed. It is not a general-purpose code execution platform or autonomous deployment system.