The agreement behind the pull requests

These terms are a contract between you and Mendr, operated by Arjan Jassal ("Mendr", "we", or "us"). By installing the Mendr GitHub App, creating an account, purchasing a plan, or using Mendr's applications and APIs (the "service"), you agree to these terms. If you use Mendr for an organization, you confirm that you have authority to bind that organization.

Mendr scans repositories you connect, identifies security vulnerabilities, and proposes fixes as pull requests. The service can also manage findings, run configured scans and notifications, and connect to third-party services such as Jira, Slack, and Vanta. AI-assisted fixes are prepared in isolated sandboxes and checked before publication. The mechanics are described on our security page.

Features, supported ecosystems, usage limits, and integrations can change. We may add, change, or remove beta or preview functionality at any time.

You sign in with GitHub and grant access through a GitHub App installation you control. You may connect only repositories, workspaces, and third-party accounts that you are authorized to manage. You are responsible for activity under your account and for maintaining the security of connected accounts and credentials.

When you use GitHub, Vercel, OpenAI, Anthropic, xAI, Moonshot AI, Jira, Slack, Vanta, or another third-party service, that provider's terms and privacy practices also apply. You authorize Mendr to exchange data with the provider as needed for the features you configure. A provider outage, API change, permission change, or account restriction can limit the service.

You retain all rights to your repositories and other content. You grant Mendr a limited license to access, copy, process, transmit, and modify that content only to provide, secure, and support the service as you direct. You confirm that you have the rights and permissions needed for Mendr to process the content and personal information that you connect.

Fixes Mendr proposes become part of your codebase under your repository's license. We claim no ownership of your content or those fixes. Pull requests, branches, tickets, messages, and records created in connected services remain subject to that service's access and retention controls.

Mendr handles and deletes your content as described in the privacy policy, including the status of the automated cleanup rollout for source-bearing repair content.

Mendr checks candidate fixes before opening a pull request, but every fix is a proposal for human review. You decide what merges and are responsible for changes you accept. AI output can be incomplete, inaccurate, non-unique, or subject to third-party or open-source license terms. We do not warrant that a fix is correct, complete, free of side effects, or suitable for your purpose, or that the service will identify every vulnerability.

AI-assisted repairs use models enabled by Mendr. The fix page shows the model creator, model, payer, and recorded serving providers. Workspace admins can choose an offered model for new fixes where that control is available. A workspace without a model choice uses its provider's default model. Existing fixes keep their saved provider and model. On Pro and Max, workspaces can save API keys for OpenAI, Anthropic, xAI, and Moonshot AI's international platform. Free fixes run first. After that, an enabled key pays for fixes on its provider's models; other fixes use the AI budget. Mendr forwards the key and repair requests to Vercel AI Gateway, which calls the provider under the workspace's account settings, limits, and data controls. You are responsible for charges on your provider account and for compliance with that provider's terms. Mendr encrypts the key and uses it only to provide the configured repair service. If Vercel falls back to a Mendr key after a workspace-key failure, Mendr pays for that request, rejects its result, and stops the session. This does not cap charges on your own provider account.

Every new workspace receives five free fixes, and every plan includes a monthly AI budget. Mendr is the key holder for every fix that it pays for, on every plan: free fixes and fixes paid from an AI budget. Mendr pays the model cost. These covered fixes use enabled models through Vercel AI Gateway, with the routing and retention controls described in our privacy policy. A free fix counts when it starts, even if it does not produce a pull request. An AI budget is measured in model cost, including failed attempts. It resets each month, unused budget does not roll over, and new fixes pause until the reset when the remaining budget cannot pay for another fix. Free fixes and AI budgets have no cash value. We can limit, pause, or end free fixes at any time, for everyone or for a workspace or account that we believe misuses them, for example by creating workspaces to get more free fixes.

When you use a fix that Mendr covers, you confirm that you are an adult or have permission from a parent or guardian, that you are not located in a country where your selected provider does not offer service, and that you are not subject to sanctions that prohibit the use of these services. The applicable availability lists are OpenAI API countries and Anthropic countries. You agree to follow the applicable OpenAI usage policies, Anthropic usage policy, and Vercel AI Product Terms. To the extent the law permits, you will defend and indemnify Mendr against third-party claims that arise from content you submit through a covered fix or from your use of covered fixes in breach of these terms.

Mendr offers a free plan and paid plans with the prices, billing periods, and usage limits shown at purchase. Polar acts as merchant of record and authorized reseller for paid subscriptions. You purchase the subscription from Polar, while Mendr licenses and provides the service under these terms. Polar's checkout terms and privacy policy also apply to the transaction.

Paid subscriptions renew automatically for the monthly or annual period shown at checkout until canceled. Taxes, currency, renewal timing, and available payment methods are shown by Polar. You can cancel through Mendr's billing settings or Polar. Cancellation takes effect at the end of the current billing period. Fees for elapsed periods are not automatically refunded, except where required by law or Polar's applicable refund policy.

We may change plans, prices, or AI budget amounts with reasonable advance notice. A price change applies no earlier than the next renewal period and is subject to any notice or consent required by law.

• Do not use the service on systems you lack rights to access.
• Do not break, probe, evade, or disrupt the service's security, isolation, access controls, or usage limits.
• Do not use the service to introduce malicious code or to violate law or third-party rights.
• Do not resell, reverse engineer, or misrepresent the service except where applicable law does not permit that restriction.

Mendr and its licensors retain all rights in the service, branding, documentation, and software other than your content. If you provide feedback, you allow us to use it without restriction or payment, but we will not identify you publicly as its source without permission.

We work to keep Mendr reliable, but the service is provided "as is" and "as available" to the maximum extent permitted by law. We do not guarantee uninterrupted availability, security, vulnerability coverage, repair success, or compatibility with every repository or third-party service. We may suspend access to protect Mendr, connected systems, or users.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, or consequential damages, and our total liability under these terms is capped at the amounts you paid us in the twelve months before the claim (or $100 if you paid nothing). Nothing in these terms limits liability that cannot be limited by law.

You can stop using Mendr at any time. Deleting a personal account does not delete shared workspace data or cancel shared billing. Uninstalling the GitHub App deactivates the workspace, deprovisions local integration credentials, and schedules eligible subscriptions to cancel at the end of the billing period, but it does not by itself delete all workspace data or external artifacts. Workspace deletion must be requested separately before uninstall. See our privacy policy for details.

We may suspend or terminate access for a material breach of these terms, a security risk, non-payment, or conduct that could harm Mendr, our providers, or other users. Terms that by their nature should survive termination remain in effect, including ownership, disclaimers, liability limits, and payment obligations.

We will post revised terms here and update the date above. We will provide reasonable advance notice of material changes and request renewed acceptance when required. If you continue to use the service after revised terms take effect, you accept them unless applicable law requires another form of agreement.

These terms are governed by the laws of the Province of British Columbia and the federal laws of Canada applicable in it, excluding conflict-of-law rules. Disputes will be resolved in the courts of British Columbia, except where applicable law gives you a mandatory right to bring a claim elsewhere.

Questions or legal notices about these terms can be sent to hello@mendr.sh.