What private data does Code Radar avoid collecting?
Radar does not collect source text, source paths, source snippets, repository contents, secrets found in code, report payloads, raw license keys, raw hardware identifiers, or code archives.
Privacy
Source code stays where Radar runs.
Code Radar is a local-first, offline code scanner for no source upload SAST workflows. License checks and optional telemetry use metadata; scans and reports remain in the local workspace or CI runner.
Summary
No-Source-Upload Privacy
Review Code Radar privacy boundaries for no-source-upload SAST, local scans, license validation, telemetry metadata, reports, and checkout attribution.
What data is used for licensing?
License validation uses entitlement identifiers, activation identifiers, machine fingerprint hashes, optional CI repository fingerprints, plan code, status, and client version.
Can telemetry be disabled?
Yes. CLI telemetry can be disabled with `DO_NOT_TRACK=1` or `RADAR_TELEMETRY=0`, and telemetry is not required to scan source code.
Where should no-source-upload buyers go next?
Use /security/ for controls, /docs/privacy-telemetry/ for implementation details, /download/ for local proof, and /pricing/ only after the private workflow fits.
Data boundary
The privacy model should be easy to inspect before a team runs Radar as a private code security scanner on sensitive repositories.
Repository sourceNever uploaded by Radar. Source files are read only where the scan runs.
ReportsTerminal, SARIF, JSON, and HTML reports are written only to the local shell, runner, or paths requested by the user.
License validationEntitlement identifiers, activation identifiers, machine fingerprint hashes, optional CI repository fingerprints, plan code, status, and client version.
CLI telemetryCommand name, scan profile, output format, duration, file counts, finding counts, severity counts, scores, platform, architecture, and whether the command ran in GitHub Actions.
Website analyticsPage views, pricing/download/docs events, checkout events, anonymous session ids, and attribution parameters such as UTM tags.
Never collectedSource text, source paths, source snippets, repository contents, secrets found in code, report payloads, raw license keys, raw hardware identifiers, or customer code archives.
Website analytics settings
Website analytics are optional, run only in production after explicit consent, and remain disabled when Do Not Track or Global Privacy Control is active.
Website analytics are waiting for your choice.
User controls
Telemetry is not required to scan source code. These commands keep the behavior explicit for local shells and automation.
DO_NOT_TRACK=1 radar scan . --quickRADAR_TELEMETRY=0 radar scan . --quickradar license statusradar scan . --quickPrivacy FAQ
What private data does Code Radar avoid collecting?
Radar does not collect source text, source paths, source snippets, repository contents, secrets found in code, report payloads, raw license keys, raw hardware identifiers, or code archives.
What data is used for licensing?
License validation uses entitlement identifiers, activation identifiers, machine fingerprint hashes, optional CI repository fingerprints, plan code, status, and client version.
Can telemetry be disabled?
Yes. CLI telemetry can be disabled with `DO_NOT_TRACK=1` or `RADAR_TELEMETRY=0`, and telemetry is not required to scan source code.
Where should no-source-upload buyers go next?
Use /security/ for controls, /docs/privacy-telemetry/ for implementation details, /download/ for local proof, and /pricing/ only after the private workflow fits.
Need the security model too?
Review licensing, entitlement validation, rate limits, and CI controls.