Your website.
Your final say.
An agent that can change code needs more than a good prompt. Here is how the hosted product limits access, prepares changes and keeps the record visible.
You choose the repositories.
Install the service’s GitHub App on the repositories you select. Your Optimiser uses the App’s installation access to read code and prepare pull requests. It does not ask each customer to hand over a personal GitHub token.
You can disconnect GitHub from your workspace or revoke the installation in GitHub. Disconnection pauses affected projects. Revoking access does not undo changes you previously merged.
Changes arrive for review.
The hosted agent proposes code changes in GitHub pull requests. Your team reviews and merges them. Follow-up comments are limited to tracked agent pull requests and authorised repository collaborators.
Project configuration controls permitted paths and actions. Instructions encountered inside a page or source file are treated as untrusted content; they do not grant new permissions.
Credentials stay on the server.
Service credentials use Google Secret Manager. Stored application credentials and authorisation grants are encrypted by the backend. Browser Firebase settings identify the authentication project and are not administrator credentials.
The API verifies account identity and tenant ownership before returning workspace records. Repository checks use a separate execution identity without the application’s database or secret permissions.
Evidence has limits.
The agent checks source files, website responses and relevant rendered content. Visual evidence can help diagnose a layout issue; it cannot establish indexing, ranking impact or real-world performance on its own.
Private pages, crawler preferences, verified business facts and existing product behaviour are constraints to preserve. Missing evidence should produce an unresolved dependency, not an invented fix.
Understand what is processed.
Relevant repository files, page content, project context and optional screenshots may be processed by a third-party AI provider to perform a task. Avoid connecting repositories containing secrets or data you do not have permission to process. The provider may change as the service evolves.
Read the privacy notice →