Installation

Sigilix is a hosted GitHub App. This page details what permissions it requests, why, and how to scope its access.

Required permissions

The Sigilix GitHub App requests the following permissions on each repository it’s installed against:

Required webhook events

Sigilix subscribes to these GitHub webhook events:

• pull_request — opened, synchronize, reopened, ready_for_review
• issue_comment — to handle @sigilix mentions
• pull_request_review_comment — to handle inline-thread mentions

No other events are subscribed to. We don’t read commits to non-PR branches, push events, or releases.

Org-level vs. repo-level install

You can install Sigilix at two scopes:

All repositories (org-level)

Choose this if you want every existing and future repository to get reviews automatically. The install screen shows “All repositories” and lists what’s covered.

Trade-offs:

• ✅ Zero config when new repos are created
• ✅ Consistent review coverage across the org
• ⚠️ Sigilix will review every PR — if you have noisy/auto-PR-heavy repos (e.g., dependabot-only repos), filter them via sigilix.json pathFilters or use repo-level install instead.

Selected repositories

Choose this to opt-in repo by repo. You can add more later from the GitHub App settings page.

OAuth scopes (sign-in)

When you sign in at app.sigilix.ai, the OAuth flow requests:

• read:user — fetch your GitHub username and email for the dashboard
• read:org — list the organizations you can install the App into

These are read-only scopes used only at sign-in time. The actual review work uses the GitHub App installation token, scoped per-repo.

Access boundary

What Sigilix does:

• Reads the diff and full file contents at the PR head SHA, scoped to files changed in the diff
• Sends those file contents to its model providers (Anthropic, OpenAI-compatible, etc.) under their data-use terms
• Discards the data after the review completes
• Stores per-PR telemetry (review duration, finding counts, severity distribution) — no source code retained

What Sigilix doesn’t do:

• Read your code outside of opened pull requests
• Train, fine-tune, or evaluate models on your code
• Share your code with other customers
• Access secrets in your repository (we read source files, not GitHub Actions secrets or environment variables)

For full data handling details, see the Sigilix Trust page, or contact support@sigilix.ai.

Install the CLI (optional)

The hosted GitHub App needs no local install. If you also want Sigilix in your terminal, install the CLI — macOS and Linux are supported, and the binary is sigilix:

# npm
npm install -g @sigilix/cli
 
# bun
bun install -g @sigilix/cli      # or run without installing: bunx @sigilix/cli
 
# Homebrew
brew install sigilix/tap/sigilix # or: brew tap sigilix/tap && brew install sigilix
 
# curl
curl -fsSL https://sigilix.ai/install | bash

Then sign in. The CLI talks to api.sigilix.ai by default — no environment variables needed:

sigilix login    # opens your browser to app.sigilix.ai and authorizes this device
sigilix whoami   # shows the signed-in user, plan, and entitlements
sigilix logout   # signs out (clears the stored key on this device)

sigilix login opens app.sigilix.ai in your browser; once you approve, the CLI stores a per-user API key for this device. The CLI is tier-aware: sigilix whoami shows your plan and whether paid-tier features — like bringing your own model key — are enabled for your account. See Sigilix CLI for what to do next.

Uninstalling

Uninstall the App at any time from your GitHub App settings:

• Personal account: github.com/settings/installations
• Org account: Org → Settings → GitHub Apps → Sigilix → Uninstall

Uninstalling immediately revokes Sigilix’s access. No further reviews are posted. Past reviews remain on PRs as historical comments.