Sign-in and data
Last updated 14 October 2026.
Short version. Signing in is optional — Polyjury works the same without it. The server has no database and keeps no accounts. Your GitHub token and, if you add one, your Nebius key are encrypted and kept in a cookie in your browser; the server reads them only while handling your request. Polyjury only ever reads public GitHub code.
Sign in with GitHub
Polyjury asks GitHub for no permissions (no scopes). The token it receives can read only what is already public. It cannot see private repositories, cannot write, comment, open issues or act on your behalf in any way.
What signing in gives you:
- A rate limit of your own, tied to your GitHub account instead of your network address, and twice as large.
- Your public repositories as a list to pick from, instead of pasting an address.
- GitHub calls made for your runs (reading a folder, the "already reported upstream?" check) use your token, so they do not compete with everyone else for the site's shared limit.
What is stored, and where
| What | Where | How long |
|---|---|---|
| GitHub token, user id, login name, avatar address | Encrypted pj_session cookie in your browser (httpOnly: page scripts cannot read it) |
7 days, or until you sign out |
| Your Nebius key, if you add one | Encrypted pj_byok cookie in your browser (httpOnly) |
7 days, or until you press "Stop using it" or sign out |
| Sign-in check value | pj_state cookie, protects the sign-in against forged requests |
10 minutes |
| "Your cases": repository, date, and each claim's title, file and verdict | This browser's localStorage only — never sent to the server | Last 12 cases, until you press "Clear this list" |
| Anything on the server | Nothing. There is no database. | — |
Each request brings the cookies with it; the server decrypts them in memory for that request and does not write or log them. Polyjury runs on Vercel, which keeps ordinary request logs (address, time, path) for every visitor, signed in or not. There are no analytics or tracking cookies. Fonts are loaded from Google Fonts.
Signing out
"Sign out" deletes both cookies and revokes the token at GitHub, so it stops working even if a copy survived somewhere. You can also revoke it yourself at any time: GitHub → Settings → Applications → Authorized OAuth Apps → Polyjury.
Your own Nebius key (BYOK)
You can run Polyjury on your own Nebius Token Factory key instead of the demo's credits. You do not need to sign in for this.
- When you add it, the key is checked once with Nebius (by listing the models it can use), then handed back to your browser encrypted. It is never shown again or echoed.
- Used for: every model call of your runs — the three jurors, and Nemotron merging, writing the proofs, auditing them, writing fixes and judging the upstream check. Those tokens bill to your Nebius account.
- Not used for: the Sandbox microVMs that run the proofs and the Tavily web search. Those still run on the demo's accounts, which is why rate limits still apply.
What happens to the code you submit
Only public GitHub repositories (or one folder of one) can be submitted, signed in or not. Their code is sent to the models on Nebius Token Factory and to a Nebius Sandbox microVM that runs the proofs; short descriptions of each claim are sent to Tavily to search the web. The download sits in the serverless instance's temporary storage while it is warm, so repeated runs do not fetch it again; it is not saved anywhere permanent.
Questions
Open an issue at
github.com/cine1052rene/polyjury.
The code that does all of the above is in that repository: polyjury/accounts.py,
polyjury/context.py and webui/account.js.