Privacy & data
What stays on your machine, what leaves it, and what the team server stores.
Stays on your machine
- Your source code. Both scanners and the AST analysis run locally. Scan results live in the project's
.securesense/folder, which SecureSense git-ignores automatically. - API keys for Groq / OpenRouter — in your OS keychain (VS Code Secret Storage), never in settings files.
What can leave your machine
| When | Where to | What is sent |
|---|---|---|
Semgrep downloads its rules (p/python) | semgrep.dev | Nothing about your code — it downloads rules. Use a local rules folder to avoid it |
| CVE lookups | OSV.dev | Package names and versions from your requirements*.txt. Disable with securesense.offline |
securesense.llm = cloud | Your chosen provider (Groq, OpenRouter, …) | The flagged function's code and its evidence summaries, to write the explanation |
| SecureSense: Sync | The SecureSense server | Findings, verdicts and decisions (below) — never whole files |
| Sign in with GitHub | GitHub | Standard GitHub sign-in; SecureSense asks only for read:user (public profile) |
With securesense.llm set to auto, hybrid or rules, no code leaves your machine at all.
Check your provider's data policy before using cloud mode on code you're not allowed to share. Free models on some services may log prompts.
What the team server stores
Only what you Sync:
| Data | Contents |
|---|---|
| Findings | File path, line numbers, vulnerability type, severity, which scanners reported it, the scanner's message and rule ids |
| AI verdicts | Classification, priority, the five evidence summaries, the rationale, which model produced it |
| Decisions | Approve / reject / investigate, when, whether it was a group action, and who (if signed in) |
| Users | GitHub id, username, display name, avatar URL — no email, no passwords, no tokens |
| Projects | Name, git-remote key, members and roles |
The evidence summaries and rationales can quote short fragments of the flagged line (e.g. request.args.get via user_id); full source files are never uploaded.
Security of the server
- Every request is authenticated with GitHub; only project members can read or write a project.
- The database password exists only on the server.
- Web sessions are an encrypted, signed cookie (AES-256-GCM, HttpOnly, Secure), valid up to 7 days.
- Decisions are credited only to the signed-in account that uploads them.
Something unclear or wrong? Edit these docs on GitHub.