Security is not a FAQ entry here — it is the first design constraint. Every claim below is enforced by code you can read, and by tests that fail the build if we break our own rules.
The scanner executes locally or in your CI and makes zero network calls by default. Our test suite greps the scan path for every networking primitive — fetch, http, sockets — and fails if one appears. The only command that touches the network is mendapi sync, and it only downloads the change feed.
If you opt in to hosted reporting, the payload is built by a whitelist: file names, line numbers, symbol names. Fields that could carry code — snippets, excerpts, hints — are structurally absent from the payload schema. A pre-transmission gate throws if any forbidden key or unredacted secret is detected.
API keys, tokens, JWTs and credential-shaped strings are redacted on every upload path as defense in depth — even inside metadata fields. Stripe live keys, AWS access keys, GitHub tokens, bearer headers and more.
The scanner is AGPL-licensed precisely so your security team can read every line that reads your code. Network transmission lives in a single module, off by default, enabled only by an explicit flag.
Fix PRs go through a GitHub App with contents:read and pull_requests:write on repos you select — never admin, never org-wide. You choose the scope; we cannot exceed it.
The Enterprise tier runs the entire stack — scanner, fix engine, change feed — on your infrastructure. Neither code nor metadata leaves your perimeter. We ship the license and the feed subscription; you keep custody.
Grep the source. The scan and fix paths contain no networking primitives, and the public test suite mechanically asserts it on every commit. Run it yourself before you trust us.
Provider names, change IDs, affected file basenames, line numbers and matched symbol names. No source lines, no code snippets, no full local paths, no environment values. The payload builder copies fields from an explicit whitelist — anything not on the list is dropped, including fields added in future versions.
Every string in the payload passes through the redaction layer before transmission. Credential-shaped values are replaced, and a final safety gate refuses to send a payload that still contains one.
Two reasons: your auditors can read everything, and anyone who forks the scanner into a hosted service must publish their changes. Trust needs both transparency and teeth.