Developer source-handling policy
These rules apply whenever you preview, access, download, or review customer source through VerifiedCode.
Required conduct
- Access source only to evaluate or complete an eligible review through the approved VerifiedCode workflow.
- Do not copy source archives, extracted files, or repository content to personal storage, personal repositories, notes, messaging tools, or unapproved devices.
- Do not submit source, screenshots, findings, or customer context to an external AI service unless VerifiedCode has explicitly approved that service and workflow in writing.
- Do not extract archives, run repository scripts, or execute build commands outside an isolated environment approved for untrusted code.
- Do not seek production credentials, production databases, customer data, or access beyond the accepted review scope.
- Do not contact the customer outside the approved platform workflow or solicit related work directly.
- Keep source, findings, customer identity, and business context confidential and use them only for the review.
- Remove downloaded archives, extracted files, repository caches, and temporary local artifacts as soon as they are no longer required and no later than review closure or access revocation.
Stop and escalate
Stop work and notify the security owner if you discover credentials, private keys, production or regulated data, malware, disputed ownership, or an actively exploitable critical vulnerability. Do not paste sensitive evidence into ordinary support, chat, analytics, or issue-tracking systems.
Source access is recorded. Assignment removal blocks repository-package access; complete lifecycle revocation remains a release gate. Claiming work records acceptance of this exact policy version.