Skip to main content

Buyer guide

Jules Data & GitHub Access Checklist

Training terms, which repositories the Google Labs Jules app can reach, secrets and environment variables, issue-borne prompt injection, and commit attribution.

Reading time
2 min read
Sources
13 cited
In this piece
Jules0 Mixed

Before developers connect repositories, confirm what Google says about training, limit the Google Labs Jules GitHub app to chosen repositories, keep secrets out of tasks, and treat GitHub issues as untrusted input. Each item maps to a Jules setting or to Google's documentation.

When you need this

  • Security must approve Jules before developers connect company repositories.
  • Jules needs credentials, environment variables, or MCP connections to finish tasks.
  • Tasks will start from GitHub issues that outside contributors can write.

Security review checklist

  1. Training terms

    Is our code used to train models?

    SetRead the privacy notice and linked legal terms in the app before connecting public repositories. The legal page requires sign-in. Google's FAQ says Jules does not train on private repository content. Its May 2025 launch post says Jules is private by default and keeps data isolated in the execution environment.

  2. Repository scope

    Which repositories can Jules reach?

    SetSelect repositories for the Google Labs Jules GitHub app under GitHub settings, Applications, Configure. Jules can reach only those repositories. One developer created a separate GitHub account in 2025 to restrict access after authorizing their own account granted access to all repositories.

  3. Secrets and environment variables

    How do credentials reach a task?

    SetSet repository environment variables before starting a task and enable those it needs. You cannot change them mid-task. Use test credentials only, since the VM has internet access. Keep secrets out of the repository, as Google's FAQ directs. Accounts allow 3 API keys. Google disables keys it finds exposed.

  4. Integrations and MCP

    Which outside services can a task call?

    SetConnect approved services with API keys in Settings. Jules offers six vetted MCP servers, Linear, Stitch, Neon, Tinybird, Context7, and Supabase, plus a Render integration. Google says it encrypts integration keys and never shares them between sessions. Scope each key to a test project.

  5. Untrusted input

    Can someone steer Jules through an issue or a comment?

    SetApply the jules label only to issues your team wrote. Require plan approval on sensitive repositories. Set Reactive Mode so Jules acts only on comments that mention it. In August 2025, a researcher showed hidden Unicode instructions in an issue causing Jules to add and run backdoor code after auto-approval.

  6. Attribution and merge control

    Whose name is on the change, and can it merge without a human?

    SetChoose commit attribution deliberately. Jules supports sole authorship, co-authorship, or the requesting user alone. Protect the default branch with required checks and reviews, since Jules creates its own pull requests. An Actions loop that merges automatically bypasses the review this guide relies on.

Questions for the security review

  1. Who read the privacy notice and the legal terms, and what do they say about prompts and public repositories?
  2. Which repositories does each developer's Jules app installation reach today?
  3. Which environment variables and MCP keys exist, and is each limited to test systems?
  4. Who can apply the jules label, and can outside contributors write those issues?

Red flags

  • The GitHub app installed on all repositories of an account with access to production code.
  • Production credentials stored as repository environment variables.
  • Jules tasks started from issues that untrusted users can edit.
  • Pull requests merged automatically after checks, with no human review.

Products in this piece

Sources

Official documentation
11
Public source
2
  1. Jules docs: FAQOfficial documentationjules.google
  2. Jules docs: Getting startedOfficial documentationjules.google
  3. Jules docs: Managing tasks and reposOfficial documentationjules.google
  4. Jules changelog: Environment variables (Oct 1, 2025)Official documentationjules.google
  5. Jules docs: IntegrationsOfficial documentationjules.google
  6. Jules changelog: MCP support (Feb 2, 2026)Official documentationjules.google
  7. Jules docs: REST API quickstart (alpha)Official documentationjules.google
  8. Jules changelog: Jules acts on PR feedback (Sep 23, 2025)Official documentationjules.google
  9. Jules changelog: CI Fixer and commit authoring (Feb 19, 2026)Official documentationjules.google
  10. Jules docs: Reviewing code changesOfficial documentationjules.google
  11. Google blog: Build with Jules, your asynchronous coding agent (May 20, 2025)Official documentationblog.google
  12. JoshMandel on Hacker News: a separate GitHub account to scope Jules's access (May 27, 2025)Public sourcenews.ycombinator.com
  13. Johann Rehberger, Embrace The Red: Google Jules is vulnerable to invisible prompt injection (Aug 15, 2025)Public sourceembracethered.com

Keep reading

  1. Buyer guideJules Delegation Playbook: From Setup Script to Mergeable Pull RequestPreparing each repository's VM, scoping a task Jules can finish, reviewing its plan, and getting the pull request through CI and review.
  2. Buyer guideJules Plans and Limits: What a Team Can BuyFree, Pro, and Ultra task limits, the personal-account restriction on paid plans, and how to run a pilot when Workspace accounts cannot upgrade.
  3. ResearchWhere Jules Stands in Google's Coding Agents, October 2026Jules beside Antigravity, Gemini CLI, and the newer Stitch Loop: what Google's own pages say, what changed in 2026, and what public GitHub activity shows.
Read the research