Skip to main content
Iris Code is built and maintained by David Jaja. The product is Iris Code; the shorter iris only survives in technical identifiers like the CLI command and the config filename.

​
Your code doesn’t leave your machine

Analysis happens in the process running on your computer. Your source, your file contents, your project name and your folder structure are not uploaded to us, and no AI model sees any of it. The extension reads the supported files in your open workspace to work out scores, duplicates and security smells. The CLI does the same thing with the same engine. Neither sends any of it anywhere.

​
Network requests

Iris Code makes bounded network requests for:
  • sign-in, licence validation, billing, and configuration sync
  • limited product-use events, controlled from account settings
  • dependency version and advisory lookups after consent
Dependency lookups send only the package ecosystem, name, and version to package registries and OSV.dev. They do not include source code, file paths, project names, or organisation names. The CLI asks before its first dependency lookup and remembers the choice in ~/.iris/preferences.json. Revoke consent at any time:

​
Workspace writes

Iris Code writes project files only after an explicit user action, such as:
  • generating or syncing .irisconfig.json
  • exporting an HTML report or CycloneDX SBOM
  • generating a CI workflow
  • locking a trend baseline
  • installing a pre-push or build hook
Trend snapshots and dependency caches stay local to the workspace.

​
Credentials

The VS Code extension stores licence credentials with VS Code’s secret-storage API. The standalone CLI can store credentials under the user’s home directory and also accepts IRIS_LICENCE_TOKEN for non-interactive CI. Never commit a licence token to .irisconfig.json, a workflow file, or source control. Store CI tokens in your CI provider’s secret manager.

​
Report a vulnerability privately

Email hello@iriscode.co with [Security] in the subject. Include:
  • the affected surface and version
  • clear reproduction steps
  • the likely impact
  • a safe proof of concept, if available
Do not include live credentials, customer data, or source code you do not own. Reports are reviewed privately before public disclosure. Iris Code does not currently operate a paid bug-bounty programme.

​
General support

For bugs, account questions, billing, or help using Iris Code, visit iriscode.co/support or email hello@iriscode.co. Read the Privacy Policy for personal-data handling and the Terms of Service for service terms.