Does Code Radar upload source code?
No. Source code, snippets, secrets, reports, and repository archives are not uploaded by Radar. Scans run in the local workspace or GitHub Actions runner.
Local code security scanning with auditable entitlement checks.
Code Radar is designed for teams that need private code security scan evidence without sending source code to another hosted scanner.
Summary
Local Scanner Security Model
Review Code Radar security controls for local code security scanning, no-source-upload SAST, license validation, telemetry metadata, and CI enforcement.
What metadata can leave the environment?
Entitlement checks, machine or repository fingerprints, plan status, client version, optional telemetry, and checkout attribution can leave the environment; repository contents do not.
How does CI preserve the boundary?
GitHub Actions scans run in the runner. Paid CI validates repository slots and entitlement online, while SARIF, JSON, HTML, and terminal outputs are written where the command runs.
What should security buyers inspect next?
Inspect the privacy page, telemetry controls, report formats, and GitHub Actions setup before adding Radar to private repositories or paid CI gates.
What leaves the machine
This is the security contract the product should be judged on. Source code stays where the scan runs; entitlement and attribution metadata go to the licensing backend.
Source codeNot uploaded by Radar. Scans run in the local workspace or GitHub Actions runner.
License keysStored server-side as HMAC hashes. Raw keys are not persisted in database rows.
Machine identityHardware-derived component hashes are sent, not raw hardware identifiers.
TelemetryMetadata-only events for attribution and product usage. No source paths, source snippets, secrets, reports, or repository contents.
CI validationGitHub Actions validates online on each run and consumes repository slots for paid CI plans.
ReportsSARIF, JSON, HTML, and terminal output are written only where the command runs.
Controls against free usage and shared-key abuse.
Radar cannot be impossible to crack, but the production design raises the cost: server-side validation, signed entitlements, database-backed plan limits, rate limits, and separate local/CI slots.
Telemetry is optional.
CLI telemetry supports product health and launch attribution, but it must not be required for source scanning. Users can opt out with standard environment controls.
DO_NOT_TRACK=1 or RADAR_TELEMETRY=0Local scanner security FAQ
Does Code Radar upload source code?
No. Source code, snippets, secrets, reports, and repository archives are not uploaded by Radar. Scans run in the local workspace or GitHub Actions runner.
What metadata can leave the environment?
Entitlement checks, machine or repository fingerprints, plan status, client version, optional telemetry, and checkout attribution can leave the environment; repository contents do not.
How does CI preserve the boundary?
GitHub Actions scans run in the runner. Paid CI validates repository slots and entitlement online, while SARIF, JSON, HTML, and terminal outputs are written where the command runs.
What should security buyers inspect next?
Inspect the privacy page, telemetry controls, report formats, and GitHub Actions setup before adding Radar to private repositories or paid CI gates.
Need the operational path?
Start with a local security review tool, then add MCP and GitHub Actions only when your workflow needs shared enforcement.