Security

Last updated: July 31, 2026

PRBoard is a read-only dashboard that organizes a developer's open GitHub pull requests into lanes by what needs their attention. This page describes exactly what access it requests and what it does with it.

GitHub App permissions

Every permission the PRBoard GitHub App requests is read-only. Here is each one and the reason it is there:

Permission	Why PRBoard needs it	What it does not do
Pull requests (read)	The core data: PR titles, state, reviews, review-thread status, and draft/merge status.	Never comments on, approves, or merges a pull request.
Checks (read)	Check-run results, which make up the aggregate CI status shown next to each PR.	Never creates or re-runs checks.
Commit statuses (read)	Legacy commit statuses, part of the same aggregate CI status.	Never writes statuses.
Contents (read)	GitHub files commit reads under this permission; PRBoard reads the head commit whose CI status is shown.	Never requests file contents, diffs, or repository code.
Members (read)	Team membership, so review requests directed at your teams appear.	Never changes membership.
Metadata (read)	The mandatory baseline for any GitHub App; repository listing.	Nothing beyond listing.
Email addresses (read)	Your verified email address, used for your account and billing receipts.	Never reads the content of your email — this is the GitHub account-email permission, not mail access.

Webhook events

The App subscribes to pull request, review, review-comment, review-thread, and check-suite events so the board updates in real time.

What PRBoard stores

Of your GitHub data, PR metadata only — repository names, PR titles and URLs, participants (logins, names, and avatars), review and CI state, and timestamps — plus your account identity, verified email address, and team memberships. PR bodies, comments, file contents, and diffs are never stored — nothing in PRBoard clones a repository or calls a content or diff API.

The full inventory of stored data — including account, billing, and product-analytics records — with retention, subprocessors, and your rights, is in the Privacy Policy.

Tokens

The GitHub App grant is read-only by registration — the table above is the complete list.
A classic personal access token, offered for organizations that restrict third-party apps, carries the repo and read:org scopes — repo includes write access. A gh CLI token carries whatever scopes it already has. PRBoard only uses these tokens to read PR data, reviews, and CI status. We never push code or modify repositories.
All tokens are encrypted at rest with AES-256-GCM and decrypted only in memory when calling GitHub. All traffic uses TLS in transit.

Revoking access

Uninstalling the App stops webhook delivery and the App's access to that installation's resources. It does not revoke a user's separate authorization — revoking that grant, under GitHub Settings → Applications → Authorized GitHub Apps, invalidates the OAuth tokens PRBoard holds for that user. Doing both removes all App-derived access.
A personal access token a user supplied is independent of the App installation: uninstalling the App does not invalidate it. It is governed by your organization's token policies — SSO enforcement, OAuth app access restrictions — and by the user revoking it on GitHub.
Deleting a PRBoard account, by email request under the privacy policy, removes your stored tokens and your account's data. The exact scope — including billing records kept under legal retention obligations — is described in the Privacy Policy.

Who operates PRBoard

PRBoard is operated by Yuya Iwabuchi, a solo developer based in Canada, who is the contact for security questions: security@prboard.dev.