Skip to main content
Version: Latest

Telemetry & Privacy

The scanner sends no scan data back to Codeward. There is no contribution, no usage reporting and no opt-out to configure — the behaviour is not switchable because it does not exist.

What the scanner sends​

Its only outbound traffic is:

  • fetching Intel snapshot segments, or querying the Intel API if you supplied a key
  • package-registry lookups to resolve licences that lockfiles do not state
  • your own url: webhook destinations

An Intel API query carries the ecosystem, name and version of the packages being scanned, because that is the question being asked. Snapshot mode (the default, and the one that needs no key) sends no package data at all — it downloads the dataset and answers locally.

Your source code never leaves the machine, in any configuration.

What is never sent​

  • Source code, file contents, or file paths
  • Repository names, URLs, or git history
  • Usernames, emails, hostnames, or IP-derived identifiers
  • Environment variables, tokens, or secrets
  • Private registry URLs or credentials

A scan with no network at all​

Snapshot mode still reaches out to download the dataset and to resolve licences. To remove even that, see Air-Gapped & Offline.