CODYGIENE

Privacy and Security

Website analytics

The public documentation website may use privacy-conscious, aggregated Vercel Web Analytics to understand documentation usage and improve the site. This website analytics is separate from the scanner and does not receive source code, scan findings, repository paths, credentials, or CLI telemetry.

What runs locally

CODYGIENE performs all source analysis locally on your machine. During a normal scan (codygiene scan), the CLI:

  • Reads files from your project directory
  • Parses and analyzes source code in memory
  • Computes findings, scores, and coverage
  • Writes the report to stdout or a file

What the scanner does NOT do

During a normal scan, CODYGIENE does not:

  • Upload source code or snippets
  • Upload repository content
  • Send findings to any external service
  • Send your repository path to any external service
  • Make HTTP requests to CODYGIENE or any other service
  • Require login or an account
  • Send telemetry or analytics
  • Connect to your database
  • Execute your code
  • Start your application

Network activity

  • Installation · requires a package registry (npm) to download the CLI
  • Scanning · no network access required or used

You can verify this by monitoring network activity during a scan. The scanner runtime contains no HTTP client calls in the analysis engine.

Verifiable guarantees

The following guarantees are factual and verifiable:

  1. No source code upload · the scanner reads files locally and processes them in memory. No file content is transmitted.

  2. No network calls during scan · the analysis engine contains zero network call sites. No fetch, axios, http.request, or similar outbound communication occurs during scanning.

  3. No telemetry · the scanner does not collect, store, or transmit usage analytics, error reports, or telemetry of any kind.

  4. No account required · scanning works without login, registration, or any CODYGIENE account.

  5. Privacy canary test · CODYGIENE includes an automated test that verifies a normal scan does not make network requests. This test runs in the CI suite and can be re-run locally.

How to verify

You can independently verify these claims by:

  • Monitoring network activity during a scan (e.g., with a firewall, tcpdump, or network monitoring tool)
  • Inspecting the package contents · the bundled CLI is a single file with no runtime dependencies
  • Running the privacy canary test included in the test suite