Terms of Service

Last updated: June 25, 2026

Service Description

PullLight is an AI-powered pull request review service that analyzes code diffs to identify security vulnerabilities and bugs. The service integrates with GitHub via a GitHub App and posts review comments on pull requests after human approval.

Key features:

Automated AI analysis of pull request diffs using Anthropic's Claude
Human approval gate — no comments are posted without human review
Security bug detection across 9 vulnerability classes (RCE, SQLi, SSRF, SSTI, path traversal, auth bypass, prototype pollution, OS command injection, deserialization)
Post-review history and severity tracking

Acceptable Use

You may use PullLight to analyze code in repositories where you have authority to do so. You may not use PullLight to:

Analyze repositories or code you do not have read access to
Use the service to intentionally identify and exploit vulnerabilities (our bug findings are for fixing, not attacking)
Resell, redistribute, or repackage the PullLight service without authorization
Attempt to reverse-engineer, decompile, or extract the proprietary AI analysis logic
Use automated tools to scrape or systematically extract findings data beyond normal use

No Warranty on Bug Detection Completeness

PullLight is a code review assistant, not a security audit. We do not guarantee that every bug or vulnerability in your codebase will be detected. Our AI analysis is probabilistic — it catches a meaningful percentage of real bugs (8/8 in our CVE benchmark), but it is not exhaustive. Use PullLight as one layer in your security posture, not as a replacement for thorough security review.

PULLLIGHT IS PROVIDED "AS IS" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE.

AI Accuracy and Limitations

AI-generated review comments reflect the analysis at the time of scan. Code evolves — a finding that was valid when posted may become stale as subsequent commits change the code. False positives are possible; always evaluate AI suggestions in context before applying fixes. PullLight is not liable for issues arising from applying or not applying AI-generated suggestions.

GitHub API Compliance

PullLight operates under GitHub's API Terms of Service. We access GitHub data only through the OAuth permissions you grant during installation, and only for the purposes described in our privacy policy. Any use of GitHub data that violates GitHub's acceptable use policies is prohibited.

PullLight reserves the right to disable or terminate accounts that use the service in ways that conflict with GitHub's developer terms.

Account and Installation

Installing PullLight on a GitHub organization requires organization owner or admin consent. Each installation is associated with a GitHub App installation ID. Uninstalling the GitHub App immediately revokes PullLight's access and stops all processing. Previously posted review comments on GitHub remain as part of your repository history and are not affected by uninstallation.

Subscription and Billing

PullLight uses Stripe for in-product subscription billing. Free and paid plans are described at pulllight.io/pricing. Paid plans are billed monthly or annually and are non-refundable after the billing period begins. You can cancel your subscription at any time — cancellation takes effect at the end of the current billing period and does not trigger a refund for the period already paid.

Termination

You may stop using PullLight at any time by uninstalling the GitHub App and canceling your subscription. We may suspend or terminate accounts that violate these terms, use the service for prohibited purposes, or fail to pay applicable fees. On termination, we will purge stored findings within 30 days as described in the privacy policy.

Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, PULLLIGHT AND ITS OPERATORS SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF PROFITS, DATA, USE, OR GOODWILL, ARISING OUT OF OR RELATED TO YOUR USE OF THE SERVICE — EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. OUR TOTAL LIABILITY SHALL NOT EXCEED THE AMOUNT YOU PAID US IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

Indemnification

You agree to indemnify and hold harmless PullLight and its operators from any claims, damages, or expenses arising from your use of the service, your violation of these terms, or your submission of code you do not have rights to.

Intellectual Property

PullLight's AI analysis logic, brand, and service design are proprietary. You retain all rights to your code. We claim no ownership over code submitted for review. By using the service, you grant us a limited license to process your diffs for analysis and to store structured findings as described in the privacy policy.

Governing Law

These terms are governed by the laws of the jurisdiction in which PullLight's operators are based. Disputes shall be resolved in the competent courts of that jurisdiction.

Changes to These Terms

We may update these terms from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the service after changes constitutes acceptance of the new terms.

Contact

Questions about these terms:
legal@pulllight.io