Iris Code is local-first, not network-free. This page explains the exact boundary so developers can evaluate it without relying on vague claims.
When you run Iris Code in your editor or from the CLI, analysis happens on your machine. Source files, file contents, project names, and workspace structure are not uploaded to an Iris Code analysis service or an AI model. Cloud scanning, described below, is a separate feature you have to connect deliberately.
Connecting a GitHub repository to Iris Code Cloud is a separate, explicit choice: it requires installing our GitHub app and confirming consent. When you do, a scan downloads a source archive onto our infrastructure, analyses it there, and discards the working copy afterwards. Iris Code does not run the repository's code or install its dependencies.
What persists is the report, not the code: file paths and per-file health scores, aggregate finding counts, the commit SHA, the branch, what triggered the scan, and the policy and engine versions used. File contents are not retained, and detected secret locations are stripped from the report before it is stored.
Reports are visible to everyone with access to that workspace. Disconnecting a repository stops future scans; deleting the project removes its reports.
Iris Code makes bounded network requests for:
Dependency lookups send only the package ecosystem, name, and version to package registries and OSV.dev. They do not include source code, file paths, project names, or organisation names. CLI consent can be revoked with --revoke-network.
The extension reads supported files and dependency manifests in the open workspace. It writes project files only after an explicit user action, such as generating a config, report, CI workflow, baseline, or installing a hook. Trend and dependency caches stay local to the workspace.
VS Code licence credentials are stored with VS Code's secret-storage API. The standalone CLI can store credentials under the user's home directory and also accepts IRIS_LICENCE_TOKEN for non-interactive CI. Never put a licence token in a committed config file.
Email hello@iriscode.co with [Security] in the subject. Include the affected surface, version, reproduction steps, likely impact, and a safe proof of concept.
Do not include live credentials, customer data, or source code you do not own. Reports are reviewed privately before any public disclosure. Iris Code does not currently operate a paid bug-bounty programme.