Security and privacy

Emendant’s scan path is deliberately local and read-only.

During scan

Emendant:

• reads supported manifests, lockfiles, configuration, .gitignore files, and relevant source files;
• uses the change feed bundled inside the installed package;
• parses source without loading or executing it; and
• prints findings to the terminal or standard output.

Emendant does not:

• upload source code;
• make a network request;
• write to the repository;
• run package scripts, tests, or application code;
• modify the Git index or history; or
• discover or transmit credentials.

The npm package has no postinstall script.

Source retention

There is no Emendant service in the scan path. Source text is read in the local process, parsed into plain matching facts, and not retained by Emendant after the process exits.

The feed

The current feed ships with the CLI, which is why a scan needs no network access. A future emendant feed update command is planned as an explicit HTTPS download of static feed data; it does not exist in the preview.

Future fix mode

The public fix workflow is not part of the current preview. Its security boundary is different and will be documented before release:

• deterministic fixes require no model;
• assisted fixes send only a bounded matched snippet directly from the user’s machine to an explicitly selected provider;
• Emendant does not receive or store that source;
• candidate patches are bounded and validated in a scratch copy; and
• Emendant never writes to Git history.

This distinction is intentional: the claim that no source leaves the machine applies to scan, not to a future assisted fix the user explicitly enables.