What is uploaded

PkgFire judges packages, not your code. What it needs is the list of packages your project would install, and that is what it receives. The privacy notice is the full statement of what is kept, why and for how long; this page is the short technical version.

What the CLI sends

For each scan:

• The dependency list read from your lockfile: each package's ecosystem, name, version, the address it is downloaded from, its integrity hash, and whether it is direct, dev-only or optional, as the lockfile says. For an install, the list before the change is sent too, so the change can be worked out.
• The project's name and where it came from: the repository's remote address, branch, commit and the subdirectory of the lockfile. Credentials in a remote address are stripped before anything is sent.
• Context about the run: the CLI's version, the operating system and architecture, the package manager, the name of the CI system if one is detected, and the install command line as you typed it. Keep credentials off that command line: it is stored as written.
• For Go, the result of the reachability analysis, which runs on your machine. The findings are sent; the code it read is not.

What is never sent

• Your source code. No file of your project is uploaded. The CLI reads what it needs to resolve and name your dependencies, and for Go the local reachability analysis reads your code on your machine; neither is sent.
• Your environment. No environment variable values, credential files or tokens are sent, other than PkgFire's own API key, which authenticates the request.
• Package code. PkgFire downloads the packages itself, from the public registry, and verifies each one against the hash in your lockfile before analysing it. Analysis runs in an isolated environment that holds no credentials.

Pull request checks

A connected repository's pull requests are checked by reading the dependency files at the base and head commits, through the access you granted when connecting. Nothing in the repository is run. PkgFire keeps the repository's name and id, pull request numbers, the commits it checked and the dependency lists it read. A token you give when connecting Forgejo or Gitea is stored encrypted and is never shown back.

Private packages

Names you list under Private packages in your policy are never looked up in public services. A private Go module is not analysed. A private npm package is analysed from the registry your lockfile names. A package you have not listed is looked up by its name like any other, even if it comes from a private registry, so list your own scopes and module hosts before you scan.

Packages that are not private are looked up by name and version in public advisory and package-metadata services. Those lookups name a package, never your project or your account.

What is kept, and who can see it

Scans, their findings and verdicts are kept in your account so you can read the history. Everyone who is a member of an account can see its projects and scans. The analysis of a public package version is shared across every account, because it describes the package, not you.

Keys and sign-in links are stored only as hashes: an API key is shown once and cannot be recovered, including by PkgFire's operator.

There are no analytics, advertising or third-party scripts on pkgfire.org.