The terms, in plain English.

1. Who we are

Trenyx is operated by Saurabh Bhatt, a sole proprietor in Ontario, Canada, trading as Trenyx ("Trenyx", "we", "us"). You can reach us at sk@trenyx.io.

2. What the service is

Each month we plant realistic bugs in a copy of your code, one at a time, and run your own test suite against each. You get a score, every planted bug your tests missed, the file and line, and the test that would have caught it. The first month includes getting your suite running and the full report, for a public or private repository.

3. Access to your code

• For a private repository you give us read-only access, usually a read-only deploy key. You can remove it at any time; the next run then doesn't happen.
• We never push to your repository or open branches or issues on it. We open a pull request only to add a test that catches one of your misses, and only with your OK.
• You confirm you have the right to share the repository with us for this purpose.
• Don't give us production secrets. Tests run with test values; if your suite needs a database or other service, we start it in a container the way your CI does.

4. Free during early access

• The service is free during early access. That includes the monthly run, every planted bug your tests missed with the test that would have caught it, and test pull requests for the misses you want. The first report is free for a public or private repository.
• If we introduce paid plans, we tell you by email at least 30 days before they apply, and we charge you nothing unless you agree to a plan first.
• Early access costs nothing and commits you to nothing. We take a limited number of new repositories each week and may decline any request.

5. Stopping

• Stop any time by replying to any report or emailing sk@trenyx.io. Your current month finishes and the next one doesn't run.

6. What the report is, and isn't

The report measures one thing: whether your test suite catches the specific bugs we planted that month. A caught bug means a test that passes on your unmodified code failed with the bug planted, and failed again on a second run. The report is not a security audit or a certification, and it doesn't promise your code is correct or secure. The planted bugs exist only in our private copy; none of them is in your shipped code.

If a run turns up a genuine bug in your shipped code, we tell you privately and separately.

7. Your code and your results

• Your code stays yours. The reports we write for you are yours to use as you like.
• We keep your code, results and reports confidential. We never publish your code, your reports or your name without your written permission.
• To write each month's bug list, your code is read by Anthropic's Claude, with training on our data switched off. It is not sent to any other AI provider.
• We delete the private copy of your code within 30 days after you stop, or sooner if you ask. Security and data has the detail.
• We keep an anonymous tally of which kinds of planted bug your tests caught or missed, and in which language, with no code, file names, repository or company name. We use it to choose which bugs to plant and count it in our published totals alongside every other run, never on its own. It stays after you stop.

8. Limits of our liability

We run every report carefully, but the service is provided as it is. To the extent the law allows, we are not liable for indirect or consequential losses, such as lost profits, lost data or business interruption, and our total liability for any claim is limited to the fees you paid us in the 3 months before the claim arose.

9. Changes to these terms

If we change these terms in a way that matters, we email users at least 30 days before the change applies to them. The date at the top shows the latest version.

10. Law

These terms are governed by the laws of Ontario and the federal laws of Canada that apply there.

See also the Privacy Policy and Security and data.