Privacy & security

RepoLens is built so that your source code has no route off your machine. This page explains what that means, how it is enforced, and how you can check it yourself instead of taking our word for it.

What happens to your files

When you open a folder, drop a ZIP or load a saved report, your browser reads the files and hands them to a Web Worker, a separate sandboxed thread on your own device. The worker parses the code, builds the graph and returns a result to the page. There is no upload endpoint, no database and no account. The server only delivers the app itself.

Code is treated as text. It is never executed, rendered as HTML, installed, or given to any other service.

If a browser cannot start the worker (some locked-down browsers and extensions block them), RepoLens runs the same analysis on the page’s own thread instead. It is just as local, and the page’s policy still forbids all network connections; only the sandbox boundary of the separate thread is lost.

How the “no network” promise is enforced

• The page cannot connect anywhere. Every response carries a Content-Security-Policy with connect-src 'none', so the browser itself blocks fetch, XHR, WebSocket and beacon requests from the page.
• The analyzer cannot either. The worker script is served with its own policy (default-src 'none'; connect-src 'none'), independent of the page. Even a compromised analyzer could not send data out.
• Only our scripts can run. Scripts need a fresh random nonce on every request (script-src 'nonce-…' 'strict-dynamic'), which blocks injected scripts. There are no third-party scripts, analytics, or tag managers, and fonts are served from this site.
• It cannot be framed or tricked into posting. frame-ancestors 'none' and form-action 'none'; the page is also sent with X-Frame-Options: DENY, Referrer-Policy: no-referrer, X-Content-Type-Options: nosniff, strict transport security, and a Permissions-Policy that disables the camera, microphone, location and similar APIs.

Verify it yourself

1. Open your browser’s developer tools and switch to the Network tab.
2. Analyze a project. You will see the page, scripts and fonts load once, and no requests at all while your files are being read and analysed.
3. Click the document request and read its Content-Security-Policy response header.
4. In the console, run fetch('https://example.com'). The browser refuses it and reports a CSP violation.

Prefer not to trust any hosted copy? RepoLens is open source: run npm install && npm run build && npm start on your own machine, or use the command-line tool, which never opens a network connection.

What the site stores

• On your device: one preference, your theme (ink or paper), in localStorage. No project data is ever stored. Close the tab and it is gone.
• No cookies, no tracking, no analytics.
• On the server: the host that serves this site may keep ordinary web-server logs (such as your IP address and the pages requested), as any website does. Those logs cannot contain anything about your projects, because project data never reaches the server.

What reports contain

Exported reports hold file paths, structure metrics and findings, and never the text of your source files. For credential findings, only the kind of secret and its line number are recorded. The value is never captured, so it cannot leak into a report, a screenshot or a Markdown summary. Reports you load are validated field by field against strict bounds before use, so a crafted file cannot inject content or crash the app.

Hostile and oversized input

Projects are untrusted input. RepoLens skips dependency folders, build output, lockfiles, source maps, minified files, hidden files and common secret files such as .env and private keys before reading them. Absolute paths, path traversal, control characters and duplicate paths are rejected. Limits apply to file count (60,000), readable text (100 MB), single files (1 MB), and ZIP size (100 MB compressed, 300 MB expanded, with entry-count and size-mismatch checks). Folders are scanned on your device and respect .gitignore, so ignored folders are never opened. Analysis runs under a time limit, and the analyzer’s pattern matching is tested against pathological inputs.

What this does not protect against

• Browser extensions and a compromised device can read what is on screen. They are outside RepoLens’s control.
• Like every website, you trust the host to serve unmodified code. If that matters, build and run it yourself.
• The secret and risky-code checks are pattern-based. They can miss real problems and flag harmless code. RepoLens is not a security audit.

Data protection (GDPR, UK GDPR, CCPA)

RepoLens itself does not collect, store or sell personal data: there is no account, no form, no cookie, no analytics and no third-party script, and your project files never reach the operator. Because the app collects nothing, there is nothing to access, correct, export or delete, and no consent banner is needed (the one stored preference, your theme, is a strictly necessary setting that stays on your device).

The only data a visit can generate is the ordinary request log kept by whichever company hosts the site (typically IP address, time, page and browser). That processing is the host's, is limited to running and securing the service, and is governed by the host's own policy. If you run your own copy, you control that entirely. Questions can be raised through GitHub issues. The site is not directed at children.

Changes to this page are recorded in the public commit history. See also the terms of use and open-source licences.

Reporting a vulnerability

If you find a security problem, please report it privately through GitHub’s private vulnerability reporting rather than a public issue, and give us a reasonable chance to fix it first.