HOSTED DATA MAP · UPDATED 5 OCTOBER 2026
Understand what hosted reviews process, what evidence stays in the workspace and which controls delete eligible records. Evaluation requests and the optional single-recipient email pilot have separate purposes below.
HOSTED GITHUB PRODUCT
Connected workspace reviews retain PR metadata, findings, evidence excerpts, and structured reports. When AI is enabled, bounded code context is processed through Cloudflare Workers AI. Fix proposals contain old and proposed file content; they expire after one hour, and scheduled cleanup clears proposal content after 24 hours except during pending or running publication. This is not a zero-retention service.
Static repository context may read up to 24 authorized JavaScript or TypeScript files (384 KiB total). Full context files remain in Worker memory; stored reports retain selected evidence lines and paths. Static supporting context is excluded from AI requests by default. Only an explicitly opted-in repository with an enabled operator gate can send a bounded packet of selected adjacent helper, guard and test excerpts from the immutable reviewed commit to Cloudflare Workers AI. The entire repository is not sent; exclusions, missing context and packet limits still apply. Pattern-based credential minimization omits matching changed-code hunks before AI analysis and masks matching finding text before storage or publication. This is a limited safeguard, not a guarantee that all sensitive data is detected. Selected evidence remains subject to the retention controls above. Reviewer decisions retain a status, reason, actor, and evidence fingerprint. Published-fix validation stores GitHub check names, states, durations, and commit identifiers, without raw CI logs.
New review runs in the review-evidence update also retain bounded delivery milestones: fixed stage codes, attempts, observation timestamps, retry eligibility and minimal failure/publication status. These records contain no source or provider response bodies. History is capped at 100 milestones per tracked run; older runs do not receive reconstructed observations. Administrators can include eligible terminal milestones in an exact retention preview and explicitly delete that metadata. Missing or deleted observations remain unavailable; local publication records do not independently verify delivery on GitHub.
A recovery journal temporarily retains a report while GitHub publication is incomplete. Successful completion clears that journal payload in the same transaction and keeps minimal commit and provider identifiers. Administrators may preview and explicitly delete eligible report snapshots, older finalized recovery payloads, and terminal fix payloads under the workspace retention setting. Saving a retention period does not schedule deletion; findings, feedback, audit, billing, and authentication records remain. This is separate from scheduled fix-proposal expiration and does not erase provider-managed copies or backups.
Read the product's processing and access boundaries. Contact privacy@codlab.app about account or review records. The enterprise pilot and optional email workflow described below are separate from hosted repository review.
PUBLIC PR EVALUATIONS · 4 OCTOBER 2026
The form on our SaaS evaluation page collects a public GitHub PR link, your reply email address and a short description of your review problem. CodLab uses this information to respond and arrange the evaluation you request. It does not subscribe you to marketing emails or enroll you in a paid plan.
Cloudflare processes the form and delivers the request to CodLab’s Google Workspace inbox. The form does not fetch your repository, run an AI review, create a customer account or add you to an email sequence. Any evaluation scope and timing are agreed by email.
Do not submit private source code, credentials or confidential customer information. The PR link, reply address and description are included in the request email and kept with the related correspondence. Network metadata is used for basic abuse prevention; submitted descriptions are not added to application analytics.
Contact privacy@codlab.app about access, correction or deletion of evaluation-request information. The controller details appear below. The separate enterprise pilot and optional onboarding notice below describes those workflows, not a marketing subscription created by this form.
PILOT CONSENT NOTICE · 2026-09-05.V4
This notice describes how contact and deployment-control data is intended to be handled when an enterprise representative prepares a CodLab VPC sandbox request or optionally requests the two-message onboarding sequence.
[ 01 / PRIVACY NOTICE ]
Pilot consent notice version: 5 September 2026. Hosted data map updated: 5 October 2026. This website copy is an evidence-scoped implementation draft and does not replace counsel’s determination of controller roles, lawful bases, international-transfer safeguards, or jurisdiction-specific duties.
Activation status: the controller identity and physical postal address supplied by the operator are now published. Production email remains fail-closed until every technical gate passes and activation receives explicit approval.
This notice applies to the local pilot preflight, a submitted sandbox request, consent verification, the two-message onboarding sequence, provider delivery events, and suppression. It does not alter the separate source-code processing terms for an authorized CodLab deployment.
The local website preflight remains usable without an email address and without consenting to the sequence.
Local email retention is disabled and unconfigured by default. An authenticated operator must choose periods, inspect a metadata-only preview and approve it within ten minutes. The approved operation minimizes eligible contact, consent evidence and encrypted message payloads, and removes eligible tokens and processed provider events. Suppression hashes, active holds, unresolved delivery attempts and audit or acceptance receipts remain. It does not delete provider-managed logs or backups. The schedule below is proposed; it is not an active deletion policy.
Expire the token, purge the recipient address, and retain only non-identifying abuse-control evidence where necessary.
Retain only the contact and control metadata required to administer, close, or audit the request.
Retain the notice version, purpose, timestamps, source, confirmation evidence, and withdrawal state; counsel must approve the final period.
Exclude message bodies and source data; extend only under an approved incident or legal-hold procedure.
Keep the minimum opaque or hashed recipient reference, scope, reason, and timestamp; review annually, but do not delete if deletion would permit an unwanted resend.
The production gate requires POST /v1/email/suppressions and the one-click route POST /email/unsubscribe/{signed_control} to be live, durable, monitored, and idempotent before any onboarding message is enabled. Unsubscribe uses a reusable, purpose-scoped signed control for the hashed pilot recipient. GET only displays the control; an explicit POST withdraws consent and suppresses pending and future pilot sends. It does not re-enable sending. Confirmation tokens remain single-use.
204 No Content whether a valid request creates the suppression or finds it already present.Where the GDPR applies, you may request access, correction, erasure, restriction, portability, or object to processing. You may withdraw consent at any time without affecting processing that occurred before withdrawal, and you may lodge a complaint with your competent supervisory authority.
Submit requests to privacy@codlab.app. Identity verification will be proportionate to the request and will not require credentials or source code.
Resend may receive the minimum contact and delivery metadata required to send and operate the optional sequence, subject to executed data-processing terms, a reviewed subprocessor record, documented processing regions, access roles, retention, incident duties, and any required transfer mechanism.
Selection is not activation. This static notice contains no provider credential, and the runtime remains configured to send nothing until every activation gate passes.
Email consent, delivery, and suppression automation does not make a solely automated decision producing legal or similarly significant effects. Security automation may stop a message from sending; a human-controlled channel remains available for the underlying pilot request.
CodLab will protect the service with access control, encryption, signed requests, replay defense, audit logging, and data minimization. A material change to purpose or consent requires a new notice version and, where required, renewed affirmative consent.
This technical reference supports the restricted pilot. It does not describe a general hosted email onboarding service.
[ 02 / RESEND ACTIVATION ]
Resend is the sole provider in this release. The website publishes binding names and validation logic only; API keys, webhook secrets, the account-issued DKIM key, and the physical address must enter through the private operator path.
EMAIL_SYSTEM_STATE=fail-closed
EMAIL_SEND_ENABLED=false
EMAIL_PROVIDER=resend
EMAIL_PROVIDER_SECRET_KEY=<WORKER SECRET BINDING>
WEBHOOK_SIGNING_SECRET=<WORKER SECRET BINDING>
SUPPRESSION_API_ENDPOINT=<WORKER SECRET BINDING>
EMAIL_SENDING_DOMAIN=codlab.app
EMAIL_FROM="codecr Enterprise Operations <onboarding@codlab.app>"
EMAIL_REPLY_TO=privacy@codlab.app
EMAIL_CONSENT_NOTICE_VERSION=2026-09-05.v4
DOUBLE_OPT_IN_REQUIRED=true
CONTROLLER_IDENTITY="Rashad Elkersawy / codecr"
CONTROLLER_POSTAL_ADDRESS="Rashad Elkersawy / codecr, Friedrich-Naumann-Str. 66, 26125 Oldenburg, Germany".env.production template codlab.app domain and wait for Resend to report Verified.2026-09-05.v4; only then permit the durable transition to active.This matrix assumes the Resend domain entry is exactly codlab.app in us-east-1. Cloudflare receives the relative names shown below. The MX and SPF values are exact for that configuration; the DKIM public key is unique to the Resend account and must be pasted verbatim. If the Resend screen emits a different region, selector, record type, or target, the account screen is authoritative—update the environment contract to match and never translate it into an example.
| PURPOSE | TYPE | CLOUDFLARE NAME | CONTENT |
|---|---|---|---|
| MAIL FROM / return path | MX | sendsend.codlab.app | feedback-smtp.us-east-1.amazonses.comPriority 10 |
| SPF | TXT | sendsend.codlab.app | v=spf1 include:amazonses.com ~all |
| DKIM | TXT | resend._domainkeyresend._domainkey.codlab.app | p=[PASTE VERBATIM RESEND-ISSUED PUBLIC KEY]Account-specific · no invented value |
| DMARC monitor | TXT | _dmarc_dmarc.codlab.app | v=DMARC1; p=none; rua=mailto:dmarc@codlab.app; adkim=r; aspf=r; pct=100 |
Do not disturb inbound mail: the send MX is a custom return-path record, not the apex inbound MX.
Keep one policy: if _dmarc.codlab.app already exists, review and update that record; never publish a second DMARC record.
Proxy off: email-authentication records are DNS-only. If Resend returns a CNAME for this account, preserve its exact type and target and keep it DNS-only.
Read the raw body before JSON parsing and verify svix-id, svix-timestamp, and svix-signature against the Resend-issued WEBHOOK_SIGNING_SECRET. Reject invalid or stale signatures before any state change.
Content-Type: application/json
svix-id: msg_...
svix-timestamp: 1788631200
svix-signature: v1,...
{
"schema_version": "1.0",
"provider": "resend",
"provider_event_id": "evt_opaque",
"provider_message_id": "msg_opaque",
"event": "delivered | bounced | complained | unsubscribed",
"occurred_at": "2026-09-05T18:05:00Z",
"recipient_ref": "recipient_opaque",
"preflight_id": "pilot_01J..."
}Require a narrowly scoped service token and idempotency key. Store the suppression before acknowledging a provider complaint, hard bounce, unsubscribe, pilot withdrawal, or cancellation.
Authorization: Bearer <email:suppress token>
Content-Type: application/json
Idempotency-Key: sup_<recipient_ref>_<reason>
X-Request-ID: req_01J...
{
"recipient_ref": "recipient_opaque",
"scope": "vpc_sandbox_onboarding",
"reason": "unsubscribe | complaint | hard_bounce | withdrawal",
"source": "one_click | provider_webhook | operator",
"requested_at": "2026-09-05T18:10:00Z",
"notice_version": "2026-09-05.v4"
}Consent requested with affirmative_action=true; verification is pending.
Unchecked/absent consent, accepted provider event, duplicate event, created suppression, or already-suppressed recipient.
Malformed body, unsupported event, or invalid content type.
Missing or invalid signature; missing token; or insufficient email:suppress scope.
Payload exceeds 256 KiB. Do not parse or log it.
Rate limit or temporary dependency failure. Provider may retry with bounded backoff.
Run from the private api.codlab.app Worker repository while EMAIL_SEND_ENABLED=false. The utility accepts masked CI variables or prompts without echo; it pipes values to Wrangler over stdin and clears the shell variables on exit.
cd /secure/path/to/codecr-email-api
chmod 0700 ./ops/inject-codecr-resend-secrets.sh
# Interactive operator path: values are requested without echo.
./ops/inject-codecr-resend-secrets.sh
# CI path: map protected, masked variables by name only.
EMAIL_PROVIDER_SECRET_KEY="${CI_RESEND_API_KEY:?}" \
WEBHOOK_SIGNING_SECRET="${CI_RESEND_WEBHOOK_SECRET:?}" \
SUPPRESSION_API_ENDPOINT="https://api.codlab.app/v1/email/suppressions" \
./ops/inject-codecr-resend-secrets.sh
# Verify binding names only; no command can read the values back.
npx wrangler secret list --env productionSet the physical postal address in the protected release job, then hydrate the built Privacy Notice, both rendered CAN-SPAM footer examples, and the downloadable onboarding contract. The script HTML-escapes the site copy, safely rewrites JSON, rejects multiline or placeholder values, and never prints the address.
cd /secure/path/to/codecr-site
read -r -p "Corporate postal address: " CORPORATE_POSTAL_ADDRESS
export CORPORATE_POSTAL_ADDRESS
chmod 0700 ./dist/assets/hydrate-codecr-legal-address.sh
./dist/assets/hydrate-codecr-legal-address.sh ./dist
unset CORPORATE_POSTAL_ADDRESS
# This must return no matches in legal pages or email contract.
rg -n --fixed-strings \
'[Insert Corporate Headquarters Address Here]' \
dist/index.html dist/privacy/index.html \
dist/assets/codecr-day2-executive-onboarding-sequence.jsonRun only from the private api.codlab.app Worker repository after the hydrated legal build is live. The script validates DNS and suppression health, deploys closed, requires the API preflight to report all three secret binding names present without exposing values, and writes an audited durable state revision.
chmod 0700 activate-codecr-email-funnel.sh
./activate-codecr-email-funnel.sh /secure/path/.env.production
# Required terminal result:
PASS: codecr onboarding email state is active; Resend is verified and double opt-in remains mandatory.Versioned JSON containing secret binding names, the codlab.app DNS matrix, legal-hydration targets, endpoint paths, consent states, and durable activation invariants.
Release boundary: this public contract contains no secret values and does not by itself prove runtime readiness. Email remains disabled until the authenticated completion record proves every gate and an authorized operator explicitly approves activation.