Know where
your code goes.
Local analysis and cloud scanning have different boundaries. Here is what each reads, sends and keeps.
Report a vulnerability privatelyLocal-first.
Cloud by choice.
Editor, CLI, hooks and CI
Your machine or your own runner
Read your source
Supported files and dependency manifests in the open workspace.
Analyse locally
Source, file contents, project names and workspace structure are not uploaded to an analysis service or AI model.
Keep local records
Trend and dependency caches stay local to the workspace. Project files are written only after your explicit action.
Connected GitHub repositories
Iris Code Cloud, only after opt-in
Connect deliberately
Install the GitHub app and confirm consent. A scan downloads a source archive onto our infrastructure.
Analyse, then discard
Iris Code does not run repository code or install dependencies. The working source copy is discarded afterwards.
Keep the report
File paths, scores and scan metadata persist. File contents are not retained; detected secret locations are stripped before storage.
Analysis in your editor stays on your machine
When you run Iris Code in your editor or from the CLI, analysis happens on your machine. Source files, file contents, project names, and workspace structure are not uploaded to an Iris Code analysis service or an AI model. Cloud scanning, described below, is a separate feature you have to connect deliberately.
Cloud scanning is opt-in, and it does process your code
Connecting a GitHub repository to Iris Code Cloud is a separate, explicit choice: it requires installing our GitHub app and confirming consent. When you do, a scan downloads a source archive onto our infrastructure, analyses it there, and discards the working copy afterwards. Iris Code does not run the repository's code or install its dependencies.
What persists is the report, not the code:
- file paths and per-file health scores
- aggregate finding counts
- the commit SHA
- the branch
- what triggered the scan
- the policy and engine versions used
File contents are not retained, and detected secret locations are stripped from the report before it is stored.
Reports are visible to everyone with access to that workspace. Disconnecting a repository stops future scans; deleting the project removes its reports.
Network boundaries
Iris Code makes bounded network requests for:
- sign-in, licence validation, billing, and configuration sync
- limited product-use events, controlled from account settings
- dependency version and advisory lookups after consent
Dependency lookups send only the package ecosystem, name, and version to package registries and OSV.dev. They do not include source code, file paths, project names, or organisation names. CLI consent can be revoked with --revoke-network.
Workspace access and writes
The extension reads supported files and dependency manifests in the open workspace. It writes project files only after an explicit user action, such as generating a config, report, CI workflow, baseline, or installing a hook. Trend and dependency caches stay local to the workspace.
Accounts and credentials
VS Code licence credentials are stored with VS Code's secret-storage API. The standalone CLI can store credentials under the user's home directory and also accepts IRIS_LICENCE_TOKEN for non-interactive CI. Never put a licence token in a committed config file.
Schema reads declarations, not your live database
Reads schema declarations in your repository. No live database connection or credentials are needed. It does not query your data or verify the deployed database. Cloud reports include Schema when supported declarations can be read. Cloud scanning uses the selected account or team allowance and repository permissions. Repositories start manual-only; automatic triggers are an explicit opt-in within the same allowance, including Free. Schema-only repositories do not produce a code-health audit.
Report a vulnerability privately
Email hello@iriscode.co with [Security] in the subject. Include the affected surface, version, reproduction steps, likely impact, and a safe proof of concept.
Do not include live credentials, customer data, or source code you do not own. Reports are reviewed privately before any public disclosure. Iris Code does not currently operate a paid bug-bounty programme.
Agree on scope before testing hosted services
Contact us before testing Iris Code Cloud or another hosted service. Testing may begin only after written authorization identifies the permitted targets, methods, test accounts, timing and request limits. Use repositories and data you own or have permission to test. Do not access another customer's data, disrupt services, send unsolicited messages or test third-party providers.
If you encounter another person's data, stop and report the minimum details needed to locate the issue; do not copy or retain that data. Receiving a report or an audit proposal does not authorize testing or create a paid engagement. A proposed audit needs a separately agreed scope, deliverables and fee.