Privacy model
Local by default. Explicit when online.
Scanning, rule evaluation, scoring and history are fully offline. Online checks run only after you grant consent — and only to the official source for that lookup.
OFF — default
No network request is ever issued. Consent loading or consumption failures also block requests.
CHECK ONCE
Authorises exactly one enrichment operation, then automatically reverts to OFF. The one-shot grant is consumed atomically; failure or cancellation leaves it OFF.
ALWAYS
Authorises enrichment until you revoke it. Revocation is persisted first and honoured before any new request.
What is sent, exactly
Package coordinates — not your code.
Advisory lookup (OSV)
For each package: the canonical ecosystem, the package name, and the exact resolved version — e.g. {"package": {"name": "…", "ecosystem": "…"}, "version": "…"} to https://api.osv.dev/v1/querybatch. Unresolved constraints are filtered out and never submitted as installed versions.
Registry metadata
The package name (and group, where applicable) to the official registry for that ecosystem — npm, PyPI, crates.io, NuGet, Go module proxy, Maven Central, Packagist, RubyGems. Redirects are disabled; any redirect target must independently pass the allowlist.
Not transmitted: source code, file contents, file paths, repository names or remotes, usernames, machine identifiers, or personal data. Ordinary TLS network metadata applies on every HTTPS request — this page does not claim otherwise.
Local storage: results cache locally (OSV 12 hours, registry 24 hours); consent mode is stored locally. Clear the cache any time in the app. Transport is backend-only (Rust); the frontend cannot pass URLs, paths or raw endpoints.