Local-only code analysis: how it works and what leaves your machine

Your code never leaves the tab

When you pick a folder, the browser hands the page read access to those files — the File System Access API on Chromium, the classic folder input everywhere else. The bytes are read into the tab's memory. The parser is WebAssembly compiled from tree-sitter, executing on your CPU. There is no upload endpoint; there is nowhere for your code to go.

This is verifiable, not a slogan: open DevTools → Network, filter to requests that are not to this domain, and use the tool. The list stays empty. The page's Content-Security-Policy enforces this at the browser level — no third-party origin is permitted, so even compromised page code has nowhere to send your work.

Every network request the app makes

The complete list. Everything else happens offline, in your tab:

• The app's own HTML, scripts, styles and icons — from this domain.
• tree-sitter grammar files (.wasm), one per language pack you enable — from this domain, cached for a year.
• /config.json — runtime switches (rate-limit mirrors, feature flags) — from this domain.
• /api/abuse — the fair-use counters: a count of analyses and up to eight language names. Never paths, symbols, queries or contents; the server never logs the request body.
• /api/session — only if you press "Continue on another device": an AES-256-GCM-encrypted, structure-only snapshot, with the decryption key held in the URL fragment, which never reaches any server.

What "structure only" means for session sync

The transfer feature exists because people switch machines mid-task. What transfers is the analysis report — file paths, symbol names, line ranges, dependency edges, settings, aggregate stats. What never transfers: file contents. The snapshot format is defined by that absence; it is not a policy bolted on afterwards.

The report is compressed, encrypted on your device with a random 256-bit key, and stored on the server as an opaque blob under a random 128-bit id with a 14-day expiry. The key lives only in the URL fragment of the link you copy: fragments are not sent to servers, do not appear in logs, and the app scrubs the fragment from the address bar the moment the receiving device consumes it.

What this architecture does not promise

Every honest architecture has edges. Your IP address is processed at Cloudflare's edge, because that is how every site behind Cloudflare works and because the fair-use counters are keyed on a hash of it. Grammar downloads tell the CDN which language packs were fetched, in aggregate. Both facts are disclosed in the Privacy Policy, with their legal bases.

And once you export, the bundle is yours: pasting it into an AI provider puts it under that provider's terms — they may retain or train on what you submit. The tool tries to make that boundary visible, because the only thing worse than a privacy boundary is one you cannot see.