LEGAL

Telemetry

Trustabl collects anonymous usage data to help improve the product — to understand which SDKs users scan most often, catch reliability issues, and measure adoption. This page is the complete and authoritative list of every event and every property that can be sent — updated in the same commit as any event schema change.

Telemetry is off by default. On your first interactive scan, Trustabl asks you to choose a level.

trustabl telemetry status

TRUSTABL_TELEMETRY=full

Telemetry levels

In CI (CI=true or a recognized CI provider env var), telemetry defaults to Disabled unless TRUSTABL_TELEMETRY is explicitly set.

Disabled

Nothing

Minimal

anonymous_id, cli_version, ci_provider, is_new_install, exit_code — one event at scan end

Full

All events and properties listed below

What we never collect

Never

Repo names, org names, usernames, email addresses, IP addresses

Never

File paths, directory names, or filenames from the scanned repo

Never

Source code — no snippets in any form, including inside error messages

Never

Finding content — explanation text, fix text, matched code — anything a rule produced

Never

Tool or agent names from the scanned codebase

Never

LLM details — provider name, model name, API key presence

Never

Exact file counts — coarse size buckets are used instead

Never

Env var values — CI provider detected by presence only, never values

Never

Raw error strings — errors are bucketed into a closed enum before sending

Anonymous ID

Every event carries an anonymous_id that identifies the installation, not the person. It is never derived from machine fingerprinting — no hostname, no MAC address, no username hash.

Local

Random UUID v4 generated once, stored in ~/.config/trustabl/telemetry.json. Stable across runs on the same machine.

Ephemeral UUID generated per invocation, never written to disk. CI runs are counted but not session-correlated.

Events
scan.started

Fired when a scan begins, after argument validation passes
PropertyTypeNotes
osstringdarwin, linux, windows
archstringarm64, amd64
target_typestring"local" or "remote" (GitHub URL)
formatstringhuman, json, sarif
strict_modeboolWhether --strict was passed
flags_used[]stringFlag names only — never flag values
ci_providerstring
github_actions, gitlab_ci, circleci, jenkins, unknown, or ""
(not CI)
is_new_installboolFirst run on this machine

scan.completed

Fired on a successful scan (exit code 0 or 1)
PropertyTypeNotes
duration_msintWall-clock milliseconds
repo_size_bucketstring
small (<20 files), medium (<200), large (≥200). Counts
Python, TypeScript, JavaScript, Go, YAML, JSON, Markdown, C#,
PHP, and Rust files.
sdks_detected[]stringSDKs observed in code
languages_detected[]stringLanguages recognized in the repo
tools_countintTool definitions discovered
agents_countintAgent declarations discovered
findings_by_severityobjectFinding count per severity level
rule_ids_firedobject
Hit count per rule ID — no finding content included
rules_shastringCommit SHA of the rule pack used
schema_versionintRule schema version
exit_codeint0 (clean) or 1 (findings present)
features_used[]string
attest, vuln_scan, sarif_out, json_out, bom_out,
no_rules_update
repo_id_hashstring
32-char hex prefix of a salted SHA-256 of the CI repo env var
(GITHUB_REPOSITORY, CI_PROJECT_PATH, CIRCLE_PROJECT_REPONAME).
One-way — the repo name cannot be recovered. Used only for
dedup. Empty outside CI or with no recognized repo env var.

scan.failed

Fired when the scan exits with code 2 (a scanner or I/O error, not a
findings-based exit)
PropertyTypeNotes
error_categorystring
Closed enum — raw error string is never sent. Values:
rules_fetch_failed, clone_failed, parse_error, no_rules,
unknown.
phasestring
Pipeline phase where failure occurred, derived from
error_category. Values: rules, clone, inventory, unknown.
duration_msint
Wall-clock milliseconds until failure
rules_shastring
Resolved rules SHA at time of failure. Empty if failure
occurred before rules were resolved.
schema_versionint
Rule schema version at time of failure. 0 if not yet resolved.

command.run

Fired for every non-scan subcommand invocation
PropertyTypeNotes
commandstring
version, mcp, enrich, attest, verify, capabilities, rules.pull,
rules.validate, vulndb.pull

crash.reported

Fired only when a user explicitly chooses "Send anonymous crash
report" after a panic — never sent automatically. Independent of the
telemetry setting: fires the same whether telemetry is full, minimal,
or disabled.
PropertyTypeNotes
panic_valuestring
Recovered panic value, best-effort redacted of common secret
shapes (sk-ant-*, sk-proj-*, long hex/base64). Not guaranteed
free of all sensitive content.
stackstring
Scrubbed stack frames only — no argument values, no source
lines, file paths trimmed to basename:line.
versionstringCLI build version
commitstringBuild commit SHA
osstringGOOS
archstringGOARCH
rules_shastring
Always empty — build meta carries no resolved SHA at the panic
site. Reserved for future use.

First-run prompt

On the first scan in an interactive terminal (TTY), before any scan output, Trustabl asks you to choose a level. The choice is saved to ~/.config/trustabl/telemetry.json and never asked again. Empty input or no response defaults to Disabled. The prompt is never shown in CI or when output is piped.

Trustabl collects anonymous data to help improve the product.
No source code, file paths, repo names, or finding details are ever sent.
Learn more: https://trustabl.ai/telemetry

Choose a telemetry level:
1. Minimal - Version and outcome
2. Full - Usage stats
3. Disabled - No data

Enter 1, 2, or 3 [default: 3]:

Manage telemetry

Three mechanisms for explicit control, evaluated in this order:

Environment variable — highest priority

Overrides the config file.

export TRUSTABL_TELEMETRY=disabled # or: 0
export TRUSTABL_TELEMETRY=minimal
export TRUSTABL_TELEMETRY=full # or: 1

CLI command — persisted

Writes your preference to the config file. Persists across sessions.

trustabl telemetry off # disable
trustabl telemetry minimal # version and outcome only
trustabl telemetry full # all anonymous usage stats
trustabl telemetry status # show current level and its source

Config file — manual

Edit ~/.config/trustabl/telemetry.json directly. Valid mode values: "disabled", "minimal", "full".

{"mode": "minimal", "anonymous_id": "your-uuid-here"}

Where data is stored locally

~/.config/trustabl/telemetry.json

Holds the mode setting and the stable anonymous UUID. Created when a telemetry level is chosen (first-run prompt or CLI command), directory permissions 0700, file permissions 0600. Never created in CI.

~/.config/trustabl/crash-.log

Scrubbed crash report written on an unrecovered panic, mode 0600.

Crash reports

When Trustabl experiences an unrecovered panic, it always writes a scrubbed crash report to ~/.config/trustabl/crash—<UTC-timestamp>.log — even in CI or non-interactive environments. This local file is the permanent, transparent record of what was captured. Nothing is transmitted without an explicit choice: after writing the file, Trustabl prompts the user with a numbered menu, shown only in an interactive terminal.

Help us fix it? No source code or file contents are sent.
1. Send anonymous crash report
2. Open GitHub issue
3. Do nothing

Enter 1, 2, or 3 [default: 3]:

The default action is always "Do nothing". All three options are shown on every crash — "Send anonymous crash report" is never hidden or renumbered based on the telemetry setting, because crash reporting is a separate consent from usage telemetry. Choosing it fires the crash.reported event and works even when telemetry is disabled — it only no-ops if the build has no PostHog key. Choosing "Open GitHub issue" opens a pre-filled URL in the browser; no data is transmitted by Trustabl itself.

Backend

PostHog

Events are sent over HTTPS to PostHog, a product analytics platform. Trustabl does not use PostHog for advertising, profiling, or any purpose other than product improvement. Events are batched and sent asynchronously — no telemetry call ever adds latency to a scan. Network errors are silently discarded and never affect the exit code. PostHog privacy policy →

Questions? Open an issue or join the Discord.

Property	Type	Notes
os	string	darwin, linux, windows
arch	string	arm64, amd64
target_type	string	"local" or "remote" (GitHub URL)
format	string	human, json, sarif
strict_mode	bool	Whether --strict was passed
flags_used	[]string	Flag names only — never flag values
ci_provider	string	github_actions, gitlab_ci, circleci, jenkins, unknown, or "" (not CI)
is_new_install	bool	First run on this machine

Property	Type	Notes
duration_ms	int	Wall-clock milliseconds
repo_size_bucket	string	small (<20 files), medium (<200), large (≥200). Counts Python, TypeScript, JavaScript, Go, YAML, JSON, Markdown, C#, PHP, and Rust files.
sdks_detected	[]string	SDKs observed in code
languages_detected	[]string	Languages recognized in the repo
tools_count	int	Tool definitions discovered
agents_count	int	Agent declarations discovered
findings_by_severity	object	Finding count per severity level
rule_ids_fired	object	Hit count per rule ID — no finding content included
rules_sha	string	Commit SHA of the rule pack used
schema_version	int	Rule schema version
exit_code	int	0 (clean) or 1 (findings present)
features_used	[]string	attest, vuln_scan, sarif_out, json_out, bom_out, no_rules_update
repo_id_hash	string	32-char hex prefix of a salted SHA-256 of the CI repo env var (GITHUB_REPOSITORY, CI_PROJECT_PATH, CIRCLE_PROJECT_REPONAME). One-way — the repo name cannot be recovered. Used only for dedup. Empty outside CI or with no recognized repo env var.

Property	Type	Notes
error_category	string	Closed enum — raw error string is never sent. Values: rules_fetch_failed, clone_failed, parse_error, no_rules, unknown.
phase	string	Pipeline phase where failure occurred, derived from error_category. Values: rules, clone, inventory, unknown.
duration_ms	int	Wall-clock milliseconds until failure
rules_sha	string	Resolved rules SHA at time of failure. Empty if failure occurred before rules were resolved.
schema_version	int	Rule schema version at time of failure. 0 if not yet resolved.

Property	Type	Notes
panic_value	string	Recovered panic value, best-effort redacted of common secret shapes (sk-ant-, sk-proj-, long hex/base64). Not guaranteed free of all sensitive content.
stack	string	Scrubbed stack frames only — no argument values, no source lines, file paths trimmed to basename:line.
version	string	CLI build version
commit	string	Build commit SHA
os	string	GOOS
arch	string	GOARCH
rules_sha	string	Always empty — build meta carries no resolved SHA at the panic site. Reserved for future use.