Does our code get sent to a model provider?

Only what the task requires, and under whatever data terms you hold with that provider. For teams that cannot send code externally at all, the realistic options are self-hosted models or keeping the agent out of the repository entirely — we will tell you which applies on a call.

What if it opens a bad pull request?

You close it, exactly as you would with a human. The review gate is the control. The number worth watching is the accept rate: if it is low, the ticket scope is wrong more often than the model is.

Source control · Integration

Alian AI for GitHub

Agents that touch your code — safely.

GitHub is the substrate when agents need to write code. We build with scoped tokens, sandboxed Claude Code, PR-only writes, and human review gates. The Auto Issue Resolution case study is the production example.

Scope an integration →Try our AI on your problem ↑

Things we've built on GitHub

Autonomous bug-fix PRs for low-complexity tickets
Documentation generation from code changes
Code review augmentation with reasoning traces

How the integration actually works

We build as a GitHub App rather than an OAuth app. Apps get fine-grained per-repository permissions and short-lived installation tokens instead of a person's full access, which is what makes agent code-writing defensible to a security reviewer. The agent runs sandboxed, works on a branch, and opens a pull request. It never pushes to a default branch, and a human approves the merge.

What to watch for on GitHub

The constraints that decide whether this ships in weeks or drags — worth knowing before you scope, whoever builds it.

Apps, not personal access tokens: A personal token carries that human's full access to everything they can see. An App installation token is scoped to selected repositories with selected permissions and expires quickly. Where an agent touches code, this distinction is the security review.
Pull-request-only writes, always: The agent proposes and a person merges. This keeps your existing review process as the safety net rather than inventing a new one, and it means a bad change is a closed pull request rather than an incident.
Small, well-specified tickets first: Autonomous fixes work on low-complexity issues with good test coverage. Pointed at an ambiguous ticket, an agent produces a confident, wrong pull request that costs more to review than to write. Scope tightly and expand on evidence.

Questions we get about GitHub

Does our code get sent to a model provider?: Only what the task requires, and under whatever data terms you hold with that provider. For teams that cannot send code externally at all, the realistic options are self-hosted models or keeping the agent out of the repository entirely — we will tell you which applies on a call.
What if it opens a bad pull request?: You close it, exactly as you would with a human. The review gate is the control. The number worth watching is the accept rate: if it is low, the ticket scope is wrong more often than the model is.