Kudelski Security published two ways into Qodo Merge, both fixed by October 2025. In 2026, a team found Qodo's findings on a public repository citing private file paths until it turned off cross-repository features. Before Qodo reads production code, pick a deployment your Git platform supports, connect only the repositories it should index, and get retention terms into the DPA.
When you need this
- Security or legal must approve a third-party Git app that reads private code.
- Your Git server is self-managed, or code must stay in your network.
- Qodo will index a mix of private and public repositories.
Evaluation criteria
Deployment model by Git provider
Which deployment does your Git platform support?
Look forChoose a deployment your Git provider supports. Multi-tenant is the default. Enterprise offers single-tenant hosting, and on-premises runs on Kubernetes. Qodo lists on-premises support for every provider except Azure DevOps Cloud. Air-gapped support covers GitHub Enterprise, GitLab Self-Managed, Bitbucket Data Center, and Gerrit.
What Qodo indexes
What does Qodo keep about your code?
Look forConnect only the repositories you want Qodo to index. Qodo stores connected repository data in a graph database and an embeddings search index. It also keeps pull request and commit history and the summaries it generates.
Training and retention
Is your code used to train models?
Look forQodo's pricing FAQ states that it does not train models on your code and uses it only for your team's reviews. Pro Team lists strict data retention. Get the retention terms written into the DPA, which requires Enterprise.
Cross-repository context
Can findings on one repository reveal another?
Look forScope skills and repository relationships before connecting public and private repositories to one workspace. ekson73 found public Qodo skill-insight findings that cited private downstream file paths. Turning off the skills and cross-repo agents in .pr_agent.toml stopped the leak.
App and action permissions
What can the integration change?
Look forInstall Qodo on the pilot repositories only and review its app permissions. At 38C3 in 2024, Kudelski showed a write-access token leaking from the Qodo Merge GitHub Action. In January 2026, Kudelski described remote code execution on the Qodo Merge Pro app server and an exposed AWS key. Qodo fixed all issues by October 2025.
Access control and keys
Who can change settings, and whose model keys are used?
Look forSSO/SAML, audit logs, bring-your-own-key (BYOK) model access, and single-tenant hosting need Enterprise. The Trust Center lists SOC 2 and shares security documentation on request.
Questions to ask vendors
- Which deployment model does each of our Git servers support?
- Which repositories will Qodo index, and can any public repository see context from a private one?
- What does the DPA say about retention of indexes and pull request history?
- Do we need BYOK, and does that require Enterprise?
Red flags
- Connecting every repository in the organization by default.
- Public and private repositories in one workspace with cross-repo skills left on.
- A self-run action holding a token with write access on pull requests from forks.
- Relying on the pricing page's training statement without the retention terms in a contract.
Products in this piece
Sources
- Official documentation
- 7
- Public source
- 3
- Qodo docs: Deployment models
- Qodo docs: Deployment models by Git provider
- Qodo docs: On-premises
- Qodo docs: Platform architecture
- Qodo pricing
- Qodo docs: Cross-repository code review
- Qodo Trust Center
- multi-agent-os pull request #427: contain Qodo skill-insight and cross-repo leak (Sep 14, 2026)
- Kudelski Security: How We Exploited Qodo, from a PR comment to RCE and an AWS admin key (Jan 15, 2026)
- 38C3 talk: AI Meets Git, Unmasking Security Flaws in Qodo Merge (Dec 29, 2024)