What inkdex sends to mlab.sh

inkdex analyses your code on your machine. It talks to mlab.sh to check your license and to record each run, with statistics that help us improve the product. Your source code never leaves your machine.

Never sent

• Source code, or any extract of it.
• The evidence text of findings (it can quote code).
• The values of secrets inkdex finds.
• The URL of your repository: it is identified by a hash.

Sent when the license is checked

At most once an hour, and before each run:

• an installation id, drawn the first time inkdex runs on a machine (in CI it changes with every container);
• the version of the binary and its SHA-256;
• the operating system, the architecture, the CI system if any (GitHub Actions, GitLab…), the machine's hostname;
• the command you run, and the capability it uses;
• a repository id: the SHA-256 of the repository's origin URL (or of its directory).

Sent at the end of each run

• Status and duration of the run.
• Units: number of files, size, number of findings.
• Environment: operating system, architecture, number of CPUs, version.
• Repository statistics (for indexing and scanning): files and lines per language, generated and vendored files, index size, files the parser could not read.
• Dependencies: ecosystem, name, resolved and requested versions, direct or not, development or not, whether your code imports it and how often.
• Findings (for scans): rule, CWE, severity, verdict, file and line, fingerprint.

See it yourself

inkdex telemetry show

It prints exactly what the last run sent (or kept to send at the next connection).

Offline

Runs made without network access are recorded on your machine and sent the next time inkdex reaches mlab.sh, with the same content as above. See License.

Dependency check

When scan checks your dependencies for known vulnerabilities, the list of your dependencies (ecosystem, name, version) is sent to mlab.sh's vulnerability service. --no-deps turns that check off.