Privacy and data handling

Exactly what leaves your machine, when, and how to stop it.

The page for your security reviewer.

Your source code never leaves your machine

Scanning is local. The rule set is compiled into the binary on your disk, evaluation happens in a process on your machine, and findings are produced there.

No file content, no snippets, no filenames, no repository names are sent anywhere as part of scanning.

What is sent, and why

Dependency lookups

To know that lodash@4.17.20 has vulnerabilities, something must consult a vulnerability database. There is no local copy, so the extension sends package coordinates: name, version, ecosystem. For example pkg:npm/lodash@4.17.20.

Not sent: your code, your file paths, your repository name, or which file declared the dependency.

Responses are cached on disk, and a manifest save whose dependency set has not changed produces no request at all.

Threat intelligence

When you open a finding or search the intelligence browser, the identifier you are asking about is sent. That is the query.

Organisation features, when signed in

If you sign in, and only then, results can be published to your organisation: findings, SBOMs, VEX statements, triage decisions. This is what makes an organisation-wide view possible, and it is the one case where finding detail, including file paths and code snippets from the finding, leaves your machine.

Signed out, nothing is published.

Telemetry

Usage telemetry, subject to your editor’s telemetry setting.

Every count is bucketed rather than exact, so a number cannot fingerprint a repository. No paths, no package names, no rule content, no repository names, and error codes rather than error messages, because messages leak paths.

Turning it off

All telemetry, editor-wide:

{ "telemetry.telemetryLevel": "off" }

The extension honours this and additionally sets VULNETIX_NO_ANALYTICS=1 and DO_NOT_TRACK=1 in the engine’s environment. vulnetix.telemetry.enabled can only turn telemetry further off; it can never re-enable it when the editor says no.

Dependency lookups: disable the dependency scanner and the rest continues to work entirely offline.

{ "vulnetix.scan.features": { "sca": false } }

Code, secret, container and infrastructure scanning are fully local and unaffected.

Where credentials live

In your editor’s secret storage, which is the OS keychain on every desktop platform. There is deliberately no setting to hold an API key, because settings files get committed and synced.

Data residency

The Vulnetix API is hosted in AWS. For organisations with residency requirements, talk to us about the options.

Webviews cannot reach the network

The extension’s panels run under a content security policy with connect-src 'none'. They cannot make network requests at all; every piece of data they display is passed in by the extension.

This is a real property, not a claim: a compromised dependency inside a panel bundle has no route to exfiltrate anything.