Frequently asked questions.

Frequently asked questions

• How is Mergehound different from CodeRabbit or Greptile?

  Mergehound's edge is the OWASP-aligned security scans + Slack daily digest + regression detection vs a pinned baseline, all in one pipeline rather than three separate tools. Pricing is per-repo not per-seat, so a 2-engineer open-source maintainer pays the same as a 50-engineer team. Free forever for public repos — see the plans or read the side-by-side comparison.
• What does the install actually touch in my repo?

  Mergehound installs as a GitHub App with read-only access to PRs and the diff; it posts inline annotations as mergehound-bot and never opens, closes, merges, or rebases anything on its own. The only thing it writes is the comment thread on a PR, and you can revoke the GitHub App from your repo settings in one click.
  Scope: single repo first is the default for a first install — Mergehound can review one repo without ever seeing the rest of your org. Once the first review lands, expand to the rest of the org from GitHub settings, no reinstall needed. The full org-vs-repo walkthrough is on the install guide.
• What do you do with my code (data retention)?

  The diff under review plus the surrounding code needed for context are processed once for the review and then dropped from the inference path; nothing is used to train models, and aggregated retention windows are documented on our trust page. Pro and Enterprise plans include an audit log export so you can see exactly what we read and when — see the Pro plan. Need the full data flow? Contact us.
• Are you SOC2 compliant?

  Mergehound is SOC2 Type II in progress; the controls are already wired through Pro and Enterprise, including the audit log export, scoped access tokens, and a single-tenant region option on Enterprise. The full status letter, timeline, and controls map are on our trust page — read it, request the latest letter from there, or contact us to escalate to your security review.
• How does the Slack setup work?

  During install you sign in with Slack, pick a channel, and Mergehound posts one digest per day summarising open PRs, regressions, and OWASP findings. The OAuth flow asks for the minimum scopes needed to post that digest: chat:write (post the digest to your channel), chat:write.public (post to channels you haven't joined yet), and conversations.invite (so the bot can join the chosen channel). We only post to the channel you choose, never read message history, never DM users, and the bot can be removed with @mergehound unsubscribe or via the Slack admin page. The full setup walkthrough is on the install guide.