Privacy and data handling
Know what leaves your machine, what appears in a report, and what remains after a scan.
OSV receives dependency metadata, not source code
Local analyzers process protected Git snapshots. When vulnerability analysis runs, Swarm’s OSV client sends package names, exact versions, and the npm ecosystem identifier to api.osv.dev. It does not send repository source code or file hashes to OSV.
Swarm discloses the service and data categories before scheduling online analysis and includes the disclosure in its results. Package names and versions are still information about your dependencies; consider that when deciding whether to enable this check.
There is no offline advisory database mode. checks.vulnerabilities.onUnavailable determines whether a supported OSV outage blocks or warns. Setting it to warn does not disable requests or provide offline analysis. Disable the check with severity: "off" if it must not query OSV.
The update-notification request described below is separate from vulnerability scanning. Package installation and any commands you run outside Swarm also have their own network behavior.
Configure OSV availability behaviorOSV vulnerability request
- Package name
- sent
- Exact package version
- sent
- npm ecosystem identifier
- sent
Source code and file hashes are not sent to OSV.
Update notices check public release metadata
Interactive CLI commands may request https://registry.npmjs.org/zedbee/latest in a detached background process. The request retrieves public release metadata. It does not send repository code, your dependency list, file hashes, or the installed Zedbee version. npm receives ordinary connection metadata, including the requesting IP address.
Checks are attempted at most daily during ordinary use. Redirects are rejected, request time and response size are bounded, and failure does not change the command’s result. A notice never installs an update automatically.
Set ZEDBEE_NO_UPDATE_CHECK=1 or NO_UPDATE_NOTIFIER=1 in the invoking environment to disable both requests and notices. CI, redirected output, JSON, SARIF, and help/version-only invocations do not start an update check. Disabling notices does not disable OSV scanning.
The example controls Zedbee’s updater, not npm itself. npx can still resolve or install a missing package. Install the intended Zedbee version ahead of time when controlling a workflow’s network access.
ZEDBEE_NO_UPDATE_CHECK=1 npx zedbee scanSource visibility depends on the output surface
Ordinary source excerpts come from the selected target snapshot: the staged index locally, or committed HEAD in base mode. The default reporting.sourceExcerpts: "interactive" treats on-screen output differently from persisted output.
| Surface | Ordinary source excerpts | Secret finding content |
|---|---|---|
| Interactive Ink terminal | Shown when available | Always redacted |
| Redirected text, JSON, or SARIF | Omitted by default | Always redacted |
| Automatic temporary JSON report | Omitted by default | Always redacted |
--no-source suppresses ordinary excerpts for that scan; --include-source allows them. Explicit CLI choices override repository policy. The always policy or --include-source can allow source to be written to reports; never or --no-source prevents it.
Secretlint results are reduced to rule and location metadata. Detected secret values, raw match text, upstream secret messages, and secret source lines are not included in findings, exports, or excerpts. The per-scan comparison key and digest used to distinguish changed secrets are ephemeral and are not rendered or persisted.
Reports still describe your repository through file paths, check results, and dependency information. Review exports before sharing them or uploading CI artifacts.
Snapshots, reports, and caches have different lifetimes
| Data | Contents | Lifetime |
|---|---|---|
| Scan snapshots | Selected repository content in protected temporary directories | Cleanup attempted before the command returns. Cleanup failure makes the scan incomplete. |
| Automatic JSON reports | Complete normalized results; ordinary source only when policy permits | Eligible for cleanup after reporting.temporaryReportMaxAge, default 24h, on a subsequent maintenance run. The OS may remove them sooner. |
| Explicit exports | The text, JSON, or SARIF output you save | You or your CI artifact policy control retention. These are not managed temporary reports. |
| Observation cache, when enabled | Validated normalized observations and integrity metadata, not source, secret values, raw analyzer output, absolute snapshot paths, or online response bodies | Bounded local cache. Corrupt or incompatible entries are misses, not trusted results. |
| Update-notification cache | Check timestamp, release name/version, and optional Node.js requirement | Separate update.json cache. Notices older than seven days are ignored. |
Automatic scans write a complete temporary JSON report, including passes with no findings. Forced --format ink writes one when its preview overflows. Explicit text, JSON, and SARIF modes provide complete output without an automatic report file or terminal finding cap.
Temporary reports request owner-only POSIX permissions where supported: directory mode 0700 and file mode 0600. Other platforms rely on user-specific OS temporary-storage protections. These handoffs are not archives.
Report write and cleanup warnings are non-blocking maintenance diagnostics, unlike snapshot cleanup failures. A report path is printed only after a complete file exists. If writing fails, Swarm restores all findings to terminal output.
The updater stores zedbee/update.json beneath an absolute XDG_CACHE_HOME, or beneath ~/.cache otherwise. Its release metadata is separate from scan observations and is not added to structured scan reports.
Applying a fix is separate from reading a snapshot
Managed fix analysis uses isolated staged snapshots, then previews current working files that have supported candidates. Public fix plans and results omit source text, replacement text, hashes, absolute repository paths, and replayable patches. Source-bearing candidate data remains in the invoking process while it validates and applies an approved plan.
zedbee fix writes validated working files; it does not stage or commit them. Exact lint and React edits are rejected when they overlap unstaged work. Selected Prettier formatting processes the complete current working file and can reformat unstaged edits.
Review the working-tree diff before staging. The guarantee that a scan analyzes staged input is not a promise that an approved formatting operation leaves every unstaged line untouched.
git diff
git diff --cached