CLI silently exfiltrates user identity (email, name) to PostHog without consent

[coreyward]

The CLI collects and transmits personally identifiable information to PostHog without any notice, consent prompt, or opt-out mechanism:

1. Runs claude auth status to extract the user's email address
2. Falls back to git config user.email and git config user.name
3. Links this PII to a persistent machine fingerprint (node-machine-id)
4. Sends it all to PostHog (us.i.posthog.com) via identify()

This happens silently on every session. There is no disclosure in the README, no first-run consent prompt, no --no-telemetry flag, and no environment variable to disable it. The user's real email and name are exfiltrated before they even interact with the tool.

Additionally, the Axiom tracing token and PostHog API key are hardcoded in the source, meaning all user telemetry flows to the maintainer's accounts with no transparency about retention or access policies.

This is a serious privacy concern. At minimum I'd expect:

• Opt-in or clearly disclosed opt-out before any PII is collected (e.g. EXPECT_TELEMETRY=off or a --no-telemetry flag)
• No PII collection by default — anonymous usage metrics are one thing, harvesting email addresses and names tied to a machine fingerprint is another
• Clear documentation of what is collected, where it goes, and how long it's retained

Collecting anonymous, aggregate product analytics is somewhat understandable, but silently running shell commands to extract a user's identity and shipping it to third-party services is not.

expect/packages/shared/src/analytics/analytics.ts

Lines 98 to 128 in f6536d6

	const getClaudeCodeEmail = Effect.fn("getClaudeCodeEmail")(function* () {
	const stdout = yield* spawner
	.string(ChildProcess.make("claude", ["auth", "status"]))
	.pipe(Effect.timeout("5 seconds"));
	const status = yield* Schema.decodeEffect(Schema.fromJsonString(ClaudeAuthStatusResponse))(
	stdout,
	);
	return status.email;
	});
	const getGitEmail = Effect.fn("getGitEmail")(function* () {
	const email = yield* spawner.string(ChildProcess.make("git", ["config", "user.email"])).pipe(
	Effect.timeout("5 seconds"),
	Effect.map((output) => output.trim()),
	);
	if (email.length === 0) {
	return yield* Effect.fail("empty");
	}
	return email;
	});
	const getGitName = Effect.fn("getGitName")(function* () {
	const name = yield* spawner.string(ChildProcess.make("git", ["config", "user.name"])).pipe(
	Effect.timeout("5 seconds"),
	Effect.map((output) => output.trim()),
	);
	if (name.length === 0) {
	return yield* Effect.fail("empty");
	}
	return name;
	});

[coreyward]

Commit that introduces the Claude behavior literally has "lmao" in the commit message.
3ff1240

[NisargIO]

@coreyward Thanks for the feedback! I fixed in the latest version 0.0.9. We added NO_TELEMETRY=1 and removed email tracking all together

[coreyward]

Thank you. 🙏