Data and Privacy

Data and Privacy

What stays on the machine

Everything by default. Without -publish, a run makes no outbound connection except, in non-fixture mode, the Go toolchain's module proxy and checksum database during acquisition, in model mode, the configured model server, and for vulns and maintain -select vulnerable, proxy.golang.org and sum.golang.org to build the scanner (the first time each toolchain image is used, even with a fixture proxy) and https://vuln.go.dev for the database on every run unless -vulndb names a directory. The scan itself runs with no network. The data directory holds the run records, the scratch clone, snapshots, the module cache, the scanner built for each toolchain image, and fetched vulnerability database snapshots. It is created owner-only (0700). Nothing is uploaded, reported, or telemetered.

What the model sees

In model mode, tool results are sent to the model: file contents the agent asks to read, directory listings, search hits, dependency source, diffs, and compiler and test output. The system prompt is fixed and contains no repository content. The model never sees the token, the data directory paths, run ids, or the policy.

With ollama:<model> this data goes to a server on the operator's machine or one they point OLLAMA_HOST at. With anthropic:<model> the same data goes to that provider's API; the key is read from the environment and never persisted, and the provider runs only under an explicit cost cap. The default and every test path use the local provider; see Design Decisions.

What GitHub sees

With -publish and after approval: a branch with one commit, the proposal, and a pull request with a deterministic body naming the target, the base commit validated against, and the changed files. Before the run, the tool reads the repository's existence and the base branch's commit. During reconciliation it reads refs and pull requests on the proposal branch. It never comments, labels, or touches other branches.

What the records contain

The SQLite store keeps every decision the agent made, including the model's stated reason, every tool request and its result, every policy verdict, every model call with token counts and latency, and every approval with who granted it and any note. Vulnerability scans are stored too: the parsed result and the raw scanner output, compressed, which quotes repository symbols and file names. Tool results include file contents the agent read, so the store contains repository content. Treat the data directory with the sensitivity of the repositories it has processed.

Tokens are never written to the store, to logs, or to the trace output.

Credentials

GITHUB_TOKEN is read from the environment at maintain and resume and held in memory. It is sent as a bearer header to the API and supplied to Git through a credential helper that reads a variable set only for that Git process. Use a fine-grained token scoped to the one destination repository with contents and pull requests permissions.

Deleting data

Remove the data directory. The module cache inside it is created read-only by the toolchain, so restore write permission first. Recorded model responses under the repository's test data are checked in deliberately and contain only fixture content.