CODYGIENE

Privacy and Security

What runs locally

CODYGIENE performs all source analysis locally on your machine. During a normal scan (codygiene scan), the CLI:

  • Reads files from your project directory
  • Parses and analyzes source code in memory
  • Computes findings, scores, and coverage
  • Writes the report to stdout or a file

What the scanner does NOT do

During a normal scan, CODYGIENE does not:

  • Upload source code or snippets
  • Upload repository content
  • Send findings to any external service
  • Send your repository path to any external service
  • Make HTTP requests to CODYGIENE or any other service
  • Require login or an account
  • Send telemetry or analytics
  • Connect to your database
  • Execute your code
  • Start your application

Network activity

  • Installation · requires a package registry (npm) to download the CLI
  • Scanning · no network access required or used

You can verify this by monitoring network activity during a scan. The scanner runtime contains no HTTP client calls in the analysis engine.

Verifiable guarantees

The following guarantees are factual and verifiable:

  1. No source code upload · the scanner reads files locally and processes them in memory. No file content is transmitted.

  2. No network calls during scan · the analysis engine contains zero network call sites. No fetch, axios, http.request, or similar outbound communication occurs during scanning.

  3. No telemetry · the scanner does not collect, store, or transmit usage analytics, error reports, or telemetry of any kind.

  4. No account required · scanning works without login, registration, or any CODYGIENE account.

  5. Privacy canary test · CODYGIENE includes an automated test that verifies a normal scan does not make network requests. This test runs in the CI suite and can be re-run locally.

How to verify

You can independently verify these claims by:

  • Monitoring network activity during a scan (e.g., with a firewall, tcpdump, or network monitoring tool)
  • Inspecting the package contents · the bundled CLI is a single file with no runtime dependencies
  • Running the privacy canary test included in the test suite