Security and Data: Access, Permissions and Storage

LeftSize scans your AWS, Azure and Cloudflare accounts with read-only access from a GitHub Action that runs on your own GitHub runner. Your cloud credentials never leave that runner. The action sends LeftSize only the findings (resource identifiers, the rule that matched, the configuration fields the rule needs, tag names and an estimated cost), and the LeftSize GitHub App turns them into issues in your repository. This page lists exactly what LeftSize can access, what it receives, and where that data is stored.

What LeftSize can access in your cloud

LeftSize needs read-only access:

With these roles LeftSize can’t create, change or delete anything. On top of that, the action never asks for changes:

• Cloud Custodian always runs with --dry-run.
• The action removes any actions: section from the rules before Custodian runs, so no rule can change a resource even if dry-run were dropped.
• @leftsize commands that would change infrastructure (stop, delete, terminate, resize, tag and others) are refused.

How the action signs in to your cloud

The recommended setup is OpenID Connect (OIDC): for every run, GitHub Actions requests a short-lived token, and your cloud exchanges it for temporary credentials. Nothing secret is stored in GitHub; the repository only holds identifiers such as the client ID, tenant ID or role ARN.

The action uses whatever credentials the login step in your workflow sets up, so other methods also work: an Azure service principal secret, AWS access keys stored as GitHub secrets, or a self-hosted runner with a managed identity or instance profile. Those are long-lived credentials you need to protect and rotate, which is why OIDC is recommended. See AWS Setup and Azure Setup.

Cloudflare: a read-only API token

Cloudflare has no OIDC or workload identity federation for API tokens, so the scan uses a read-only API token stored as a GitHub secret (CLOUDFLARE_API_TOKEN) and passed to the action as cloudflare-api-token. The token is used on your runner only and is never sent to LeftSize. We recommend an account-owned token, which isn’t tied to a person, with a TTL that you renew, because client IP filtering doesn’t work with the changing IP addresses of GitHub-hosted runners. See Cloudflare Setup.

The Cloud Custodian process gets only the cloud credentials and basic system settings from the runner’s environment, not the GitHub token, the OIDC request token or the LeftSize repository token.

GitHub App permissions

The LeftSize GitHub App asks for two permissions, in the repositories you choose when you install it:

The app receives the issues and issue_comment events, which is how it sees @leftsize commands. It has no access to your code, pull requests, workflows, secrets or settings.

What data LeftSize receives

For each finding, the action sends:

• The resource ID: the Azure resource ID or AWS ARN, which includes the subscription or account ID, resource group, region and resource name. On Cloudflare: the account ID and the resource name, such as a zone name, Worker script name, R2 bucket name, API token ID and name, tunnel, Access application or load balancer pool name
• The rule that matched, and the scope (an Azure resource group, an AWS account and region, or a Cloudflare account)
• The configuration fields the rule needs, such as size, SKU, instance type, engine version or creation date. On Cloudflare, for example the SSL/TLS mode, the permission group names of an API token, or the names (not values) of plain-text Worker variables that look like credentials
• On Cloudflare, for the Zero Trust seat rule: the user ID and email address of Zero Trust users with an unused seat. The two-factor rule sends only the number of members without two-factor authentication, not who they are
• The names of the resource’s tags, not their values (action version 1.0.29 and later; earlier versions sent the values too)
• The environment LeftSize detected for the resource (production, acceptance, development …) and what it was based on
• The estimated monthly savings

LeftSize never receives credentials, tag values or the data inside your resources (files, databases, secrets, logs). It never receives the Cloudflare API token, the values of Worker variables or secrets, or certificate and key files: the scanner drops them on the runner. The repository token (LEFTSIZE_REPOSITORY_TOKEN) identifies your repository to the LeftSize API; it can only submit findings and read statistics for that repository.

The action is open source under the MIT license: LeftSize/leftsize-action. You can read every rule and the exact code that builds what is sent.

Where data is stored

The LeftSize backend runs on Cloudflare. The database and scan storage are in Western Europe; requests are handled by Cloudflare’s global network. The issues themselves are stored by GitHub in your repository, under your control, or by Atlassian in your Jira site if you use the Jira integration. For what the Jira app can access, see Jira: Data and permissions.

LeftSize is operated by MindByte in the Netherlands. The processors are Cloudflare (hosting, database, storage, queues, logs), GitHub (the GitHub App platform and the issues) and Scitor, also operated by MindByte (the support chat). The privacy policy is the authoritative description, including international transfers and your rights.

How long data is kept

See Data retention.

Encryption

In transit. The LeftSize API (api.leftsize.com) and the website only serve HTTPS; plain HTTP requests are redirected to HTTPS. The action refuses a backend-url that isn’t an https:// address on a LeftSize domain, because it sends the repository token with every request. LeftSize checks where requests come from: GitHub webhooks must carry a valid X-Hub-Signature-256 signature, and calls from the Jira app must carry a Forge Invocation Token signed by Atlassian for the LeftSize app.

At rest. Cloudflare encrypts the data LeftSize stores with AES-256: the database (D1), scan storage (R2), the cache (KV) and Durable Objects. On top of that, LeftSize encrypts the Jira access token itself with AES-256-GCM before it stores it, with a key that is kept as a Cloudflare secret.

Access to production

Only LeftSize’s maintainers and employees have access to the production systems. Secrets, such as the GitHub App’s private key and the encryption key, are stored as Cloudflare secrets and never in the source code or the repository.

Reporting a security issue

If you think you’ve found a security issue in LeftSize, the GitHub Action or the Jira app, email hi@leftsize.com with “Security” in the subject. Please include:

• what you found and where (the URL, the API endpoint, or the file and line in the action’s code)
• the steps to reproduce it, and what an attacker could do with it
• how we can reach you

We confirm that we received your report within a few working days and keep you informed while we work on a fix. Please don’t share the issue publicly until it’s fixed, and don’t access or change data that isn’t yours while testing. LeftSize has no bug bounty program.

Security incidents

If a security incident affects your data, we tell the affected customers by email without undue delay, with what happened, what data was affected and what we’re doing about it. Where the GDPR requires it, we report a personal data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours.

Use a private repository

LeftSize issues list your resource names, and anyone who can comment on an issue can run @leftsize commands, including the ones that close issues. Install LeftSize on a private repository, for example a dedicated cloud-findings repository, so findings and commands stay within your team. See Who can run commands.

Related

• How It Works: the scan cycle and issue lifecycle
• AWS Setup, Azure Setup and Cloudflare Setup: the exact roles, trust settings and token permissions
• FAQ: more security questions