What an assessment establishes
Wisesama matches exact npm and PyPI package metadata to sourced vulnerability records. It does not establish deployment, application reachability, an intrusion, or an independently verified fix. Resolved and Not affected responses are user attestations accompanied by written evidence.
Repository access
GitHub integration uses a GitHub App with read access to Contents and Metadata on selected repositories. GitLab.com uses read_api under the connected identity. These provider grants can read more than the inventory and configuration files Wisesama processes.
Wisesama reads supported inventory metadata and allowlisted package-manager and CI configuration for static baseline checks. It retains extracted facts, paths, and commit references rather than raw configuration. It does not execute repository code or push commits in this workflow. Manage access inside workspace integrations and revoke the provider grant in GitHub or GitLab when needed.
Public and private data
Public feeds, public email editions, API reads, and public MCP tools contain advisory intelligence. Private project inventories, findings, and response notes require current organization membership. Public subscriptions do not create repository access.
Failures remain evidence
Source outages, revoked repository access, and failed imports are shown with their last successful context. A failed check must not become a clean assessment, and removing a package from a repository does not automatically verify remediation.
Reporting and launch readiness
Do not put secrets or exploit details in public feed subscriptions or advisory searches. A dedicated vulnerability-reporting contact and operator details must be published before the service is opened for production use. No certification, audit, or response-time guarantee is claimed here.