Code host connections
The connection is scoped to a repository you choose, and what it is allowed to touch is a list you tick rather than a permission you hope is narrow.
We never merge
Search Overflow has no code that calls merge. That is the guarantee, and it is the only one we can honestly make: a token that can push a branch can technically merge one, so your branch protection is what enforces it. We say that rather than letting a badge imply otherwise.
Files that change how crawlers see you need your say-so
robots.txt, sitemap.xml, redirects and host configuration are only written when you have authorised that exact file. A proposal that touches one without authorisation is refused rather than raised.
Nothing we were not given
A change carries its whole payload. This layer never reads your working tree, so a transport that cannot write a file it was not handed is a transport that cannot exceed what the gates approved.
Questions
Which hosts can you connect to?
GitHub, GitLab, Bitbucket and Azure DevOps. GitHub connects as an app installation scoped to the repositories you pick.
Can the token you hold merge a pull request?
It may be able to. On GitHub, merging needs the same write permission as pushing a commit, so no token that can open a pull request can be denied merge. What we can tell you is that our product contains no code that calls merge, and that a required review on your default branch is the control that actually enforces it.
More in Turn a finding into a change
Run it against your own site.
No signup, no card. It reports what it could not check as well as what it found.