FAQ
Common questions about inkdex.
Does my code leave my machine?
No. inkdex reads and analyses your code locally. What it sends to mlab.sh is listed in What inkdex sends; you can check it with inkdex telemetry show.
Can we use one key on many machines?
Yes. A key and a CI token work on as many machines, VMs, containers and pipelines as you want. Every run is recorded.
Does inkdex work without network access?
For 3 days after its last connection. Runs made offline are sent at the next connection.
How long does indexing take?
The first index reads every file; later ones read only what changed, usually in seconds. The scan itself works on the index and takes seconds to a minute on large repositories.
Where is the index? Can I delete it?
In .inkdex/ at the root of the repository (added to .gitignore by inkdex init). Deleting it is safe: inkdex init then inkdex index rebuild it.
Why is a finding verify and not proven?
The index does not show the whole path with full confidence: for example a generic secret, a check known only by its name, or a flow whose source is a service your code called. Look at the evidence and decide.
A finding is wrong. What can I do?
Run inkdex explain <file> --line <n> on its line to see what inkdex understood, and contact mlab.sh with the finding's rule and fingerprint. A finding you reviewed can be dismissed with inkdex annotate dismiss, and --hide-dismissed hides it from sec flows.
An expected finding is missing.
Check that the language is in langs (see Configuration), that the file is not ignored (.gitignore, .inkdexignore, default_ignores) and is not test or generated code (inkdex q 'file flag:test,generated' lists those), and that the entry point is found (inkdex routes). inkdex explain shows how each call on a line was resolved.