Code never leaves

A tool that reads your code must prove it keeps secrets.

Security is not a FAQ entry here — it is the first design constraint. Every claim below is enforced by code you can read, and by tests that fail the build if we break our own rules.

Tap to fracture · scroll to mend

The security model

Local-first

Scans run on your machine

The scanner executes locally or in your CI and makes zero network calls by default. Our test suite greps the scan path for every networking primitive — fetch, http, sockets — and fails if one appears. The only command that touches the network is mendapi sync, and it only downloads the change feed.

Metadata-only

Source code cannot be uploaded

If you opt in to hosted reporting, the payload is built by a whitelist: file names, line numbers, symbol names. Fields that could carry code — snippets, excerpts, hints — are structurally absent from the payload schema. A pre-transmission gate throws if any forbidden key or unredacted secret is detected.

Secrets redacted

Fifteen patterns, every path

API keys, tokens, JWTs and credential-shaped strings are redacted on every upload path as defense in depth — even inside metadata fields. Stripe live keys, AWS access keys, GitHub tokens, bearer headers and more.

Auditable

Open source, line by line

The scanner is AGPL-licensed precisely so your security team can read every line that reads your code. Network transmission lives in a single module, off by default, enabled only by an explicit flag.

Least privilege

Minimal GitHub permissions

Fix PRs go through a GitHub App with contents:read and pull_requests:write on repos you select — never admin, never org-wide. You choose the scope; we cannot exceed it.

Self-hosted

Enterprise stays inside your firewall

The Enterprise tier runs the entire stack — scanner, fix engine, change feed — on your infrastructure. Neither code nor metadata leaves your perimeter. We ship the license and the feed subscription; you keep custody.

Enforced, not promised

How do I verify the scanner makes no network calls?

Grep the source. The scan and fix paths contain no networking primitives, and the public test suite mechanically asserts it on every commit. Run it yourself before you trust us.

What exactly does a hosted report contain?

Provider names, change IDs, affected file basenames, line numbers and matched symbol names. No source lines, no code snippets, no full local paths, no environment values. The payload builder copies fields from an explicit whitelist — anything not on the list is dropped, including fields added in future versions.

What if a secret ends up in a symbol name or file name?

Every string in the payload passes through the redaction layer before transmission. Credential-shaped values are replaced, and a final safety gate refuses to send a payload that still contains one.

Why AGPL?

Two reasons: your auditors can read everything, and anyone who forks the scanner into a hosted service must publish their changes. Trust needs both transparency and teeth.