LEGAL

Usage Telemetry & Privacy

Trustabl collects anonymous usage data to help improve the product — to understand which SDKs users scan most often, catch reliability issues, and measure adoption. This page is the complete and authoritative list of every event and every property that can be sent — updated in the same commit as any event schema change.

Telemetry is off by default. On your first interactive scan, Trustabl asks you to choose a level.

trustabl telemetry status

TRUSTABL_TELEMETRY=full

Telemetry levels

In CI (CI=true or a recognized CI provider env var), telemetry defaults to Disabled unless TRUSTABL_TELEMETRY is explicitly set.

Disabled

Nothing

Minimal

anonymous_id, cli_version, ci_provider, is_new_install, exit_code — one event at scan end

Full

All events and properties listed below

What we never collect

Never

Repo names, org names, usernames, email addresses, IP addresses

Never

File paths, directory names, or filenames from the scanned repo

Never

Source code — no snippets in any form, including inside error messages

Never

Finding content — explanation text, fix text, matched code — anything a rule produced

Never

Tool or agent names from the scanned codebase

Never

LLM details — provider name, model name, API key presence

Never

Exact file counts — coarse size buckets are used instead

Never

Env var values — CI provider detected by presence only, never values

Never

Raw error strings — errors are bucketed into a closed enum before sending

Anonymous ID

Every event carries an anonymous_id that identifies the installation, not the person. It is never derived from machine fingerprinting — no hostname, no MAC address, no username hash.

Local

Random UUID v4 generated once, stored in ~/.config/trustabl/telemetry.json. Stable across runs on the same machine.

CI

Ephemeral UUID generated per invocation, never written to disk. CI runs are counted but not session-correlated.

Events
        scan.started
        
          Fired when a scan begins, after argument validation passes
        
              Property
              Type
              Notes
            
              os
              string
              darwin, linux, windows
            
              arch
              string
              arm64, amd64
            
              target_type
              string
              "local" or "remote" (GitHub URL)
            
              format
              string
              human, json, sarif
            
              strict_mode
              bool
              Whether --strict was passed
            
              flags_used
              []string
              Flag names only — never flag values
            
              ci_provider
              string
              
                github_actions, gitlab_ci, circleci, jenkins, unknown, or ""
                (not CI)
              
              is_new_install
              bool
              First run on this machine
            
        scan.completed
        
          Fired on a successful scan (exit code 0 or 1)
        
              Property
              Type
              Notes
            
              duration_ms
              int
              Wall-clock milliseconds
            
              repo_size_bucket
              string
              
                small (<20 files), medium (<200), large (≥200). Counts
                Python, TypeScript, JavaScript, Go, YAML, JSON, Markdown, C#,
                PHP, and Rust files.
              
              sdks_detected
              []string
              SDKs observed in code
            
              languages_detected
              []string
              Languages recognized in the repo
            
              tools_count
              int
              Tool definitions discovered
            
              agents_count
              int
              Agent declarations discovered
            
              findings_by_severity
              object
              Finding count per severity level
            
              rule_ids_fired
              object
              
                Hit count per rule ID — no finding content included
              
              rules_sha
              string
              Commit SHA of the rule pack used
            
              schema_version
              int
              Rule schema version
            
              exit_code
              int
              0 (clean) or 1 (findings present)
            
              features_used
              []string
              
                attest, vuln_scan, sarif_out, json_out, bom_out,
                no_rules_update
              
              repo_id_hash
              string
              
                32-char hex prefix of a salted SHA-256 of the CI repo env var
                (GITHUB_REPOSITORY, CI_PROJECT_PATH, CIRCLE_PROJECT_REPONAME).
                One-way — the repo name cannot be recovered. Used only for
                dedup. Empty outside CI or with no recognized repo env var.
              
        scan.failed
        
          Fired when the scan exits with code 2 (a scanner or I/O error, not a
          findings-based exit)
        
              Property
              Type
              Notes
            
              error_category
              string
              
                Closed enum — raw error string is never sent. Values:
                rules_fetch_failed, clone_failed, parse_error, no_rules,
                unknown.
              
              phase
              string
              
                Pipeline phase where failure occurred, derived from
                error_category. Values: rules, clone, inventory, unknown.
              
              duration_ms
              int
              
                Wall-clock milliseconds until failure
              
              rules_sha
              string
              
                Resolved rules SHA at time of failure. Empty if failure
                occurred before rules were resolved.
              
              schema_version
              int
              
                Rule schema version at time of failure. 0 if not yet resolved.
              
        command.run
        
          Fired for every non-scan subcommand invocation
        
              Property
              Type
              Notes
            
              command
              string
              
                version, mcp, enrich, attest, verify, capabilities, rules.pull,
                rules.validate, vulndb.pull
              
        crash.reported
        
          Fired only when a user explicitly chooses "Send anonymous crash
          report" after a panic — never sent automatically. Independent of the
          telemetry setting: fires the same whether telemetry is full, minimal,
          or disabled.
        
              Property
              Type
              Notes
            
              panic_value
              string
              
                Recovered panic value, best-effort redacted of common secret
                shapes (sk-ant-*, sk-proj-*, long hex/base64). Not guaranteed
                free of all sensitive content.
              
              stack
              string
              
                Scrubbed stack frames only — no argument values, no source
                lines, file paths trimmed to basename:line.
              
              version
              string
              CLI build version
            
              commit
              string
              Build commit SHA
            
              os
              string
              GOOS
            
              arch
              string
              GOARCH
            
              rules_sha
              string
              
                Always empty — build meta carries no resolved SHA at the panic
                site. Reserved for future use.

Property	Type	Notes
os	string	darwin, linux, windows
arch	string	arm64, amd64
target_type	string	"local" or "remote" (GitHub URL)
format	string	human, json, sarif
strict_mode	bool	Whether --strict was passed
flags_used	[]string	Flag names only — never flag values
ci_provider	string	github_actions, gitlab_ci, circleci, jenkins, unknown, or "" (not CI)
is_new_install	bool	First run on this machine

Property	Type	Notes
duration_ms	int	Wall-clock milliseconds
repo_size_bucket	string	small (<20 files), medium (<200), large (≥200). Counts Python, TypeScript, JavaScript, Go, YAML, JSON, Markdown, C#, PHP, and Rust files.
sdks_detected	[]string	SDKs observed in code
languages_detected	[]string	Languages recognized in the repo
tools_count	int	Tool definitions discovered
agents_count	int	Agent declarations discovered
findings_by_severity	object	Finding count per severity level
rule_ids_fired	object	Hit count per rule ID — no finding content included
rules_sha	string	Commit SHA of the rule pack used
schema_version	int	Rule schema version
exit_code	int	0 (clean) or 1 (findings present)
features_used	[]string	attest, vuln_scan, sarif_out, json_out, bom_out, no_rules_update
repo_id_hash	string	32-char hex prefix of a salted SHA-256 of the CI repo env var (GITHUB_REPOSITORY, CI_PROJECT_PATH, CIRCLE_PROJECT_REPONAME). One-way — the repo name cannot be recovered. Used only for dedup. Empty outside CI or with no recognized repo env var.

Property	Type	Notes
error_category	string	Closed enum — raw error string is never sent. Values: rules_fetch_failed, clone_failed, parse_error, no_rules, unknown.
phase	string	Pipeline phase where failure occurred, derived from error_category. Values: rules, clone, inventory, unknown.
duration_ms	int	Wall-clock milliseconds until failure
rules_sha	string	Resolved rules SHA at time of failure. Empty if failure occurred before rules were resolved.
schema_version	int	Rule schema version at time of failure. 0 if not yet resolved.

Property	Type	Notes
command	string	version, mcp, enrich, attest, verify, capabilities, rules.pull, rules.validate, vulndb.pull

Property	Type	Notes
panic_value	string	Recovered panic value, best-effort redacted of common secret shapes (sk-ant-, sk-proj-, long hex/base64). Not guaranteed free of all sensitive content.
stack	string	Scrubbed stack frames only — no argument values, no source lines, file paths trimmed to basename:line.
version	string	CLI build version
commit	string	Build commit SHA
os	string	GOOS
arch	string	GOARCH
rules_sha	string	Always empty — build meta carries no resolved SHA at the panic site. Reserved for future use.

First-run prompt

On the first scan in an interactive terminal (TTY), before any scan output, Trustabl asks you to choose a level. The choice is saved to ~/.config/trustabl/telemetry.json and never asked again. Empty input or no response defaults to Disabled. The prompt is never shown in CI or when output is piped.

Trustabl collects anonymous data to help improve the product.
No source code, file paths, repo names, or finding details are ever sent.
Learn more: https://trustabl.ai/telemetry

Choose a telemetry level:
1. Minimal - Version and outcome
2. Full - Usage stats
3. Disabled - No data

Enter 1, 2, or 3 [default: 3]:

Manage telemetry

Three mechanisms for explicit control, evaluated in this order:

1

Environment variable — highest priority

Overrides the config file.

export TRUSTABL_TELEMETRY=disabled # or: 0
export TRUSTABL_TELEMETRY=minimal
export TRUSTABL_TELEMETRY=full # or: 1

2

CLI command — persisted

Writes your preference to the config file. Persists across sessions.

trustabl telemetry off # disable
trustabl telemetry minimal # version and outcome only
trustabl telemetry full # all anonymous usage stats
trustabl telemetry status # show current level and its source

3

Config file — manual

Edit ~/.config/trustabl/telemetry.json directly. Valid mode values: "disabled", "minimal", "full".

{"mode": "minimal", "anonymous_id": "your-uuid-here"}

Where data is stored locally

~/.config/trustabl/telemetry.json

Holds the mode setting and the stable anonymous UUID. Created when a telemetry level is chosen (first-run prompt or CLI command), directory permissions 0700, file permissions 0600. Never created in CI.

~/.config/trustabl/crash-.log

Scrubbed crash report written on an unrecovered panic, mode 0600.

Crash reports

When Trustabl experiences an unrecovered panic, it always writes a scrubbed crash report to ~/.config/trustabl/crash—<UTC-timestamp>.log — even in CI or non-interactive environments. This local file is the permanent, transparent record of what was captured. Nothing is transmitted without an explicit choice: after writing the file, Trustabl prompts the user with a numbered menu, shown only in an interactive terminal.

Help us fix it? No source code or file contents are sent.
1. Send anonymous crash report
2. Open GitHub issue
3. Do nothing

Enter 1, 2, or 3 [default: 3]:

The default action is always "Do nothing". All three options are shown on every crash — "Send anonymous crash report" is never hidden or renumbered based on the telemetry setting, because crash reporting is a separate consent from usage telemetry. Choosing it fires the crash.reported event and works even when telemetry is disabled — it only no-ops if the build has no PostHog key. Choosing "Open GitHub issue" opens a pre-filled URL in the browser; no data is transmitted by Trustabl itself.

Backend

PostHog

Events are sent over HTTPS to PostHog, a product analytics platform. Trustabl does not use PostHog for advertising, profiling, or any purpose other than product improvement. Events are batched and sent asynchronously — no telemetry call ever adds latency to a scan. Network errors are silently discarded and never affect the exit code. PostHog privacy policy →

Questions? Open an issue or join the Discord.