Skip to main content
Iris Code uses different data boundaries for local analysis and opt-in Cloud scans. This page explains what each workflow reads, which network requests it makes, and how to report a security issue privately.

​
Local analysis stays in your environment

Editor and CLI analysis happens in the process running on your computer. Your source, file contents, project name, and folder structure are not uploaded to Iris Code for these workflows, and Iris Code does not send them to an AI model. The extension reads supported files in the open workspace to calculate scores, duplication, and security findings. The CLI uses the same engine for local checks, hooks, and CI. Cloud scans are different. When you explicitly connect a GitHub repository, the Cloud worker temporarily fetches its source, runs the audit, deletes the working copy, and retains the commit-pinned report. See Cloud security and retention for that boundary.

​
Network requests

Iris Code makes bounded network requests for:
  • sign-in, licence validation, billing, and configuration sync
  • limited product-use events, controlled from account settings
  • dependency version and advisory lookups after consent
  • anonymous package guard counts, when you are not signed in and have allowed dependency lookups
Dependency lookups send only the package ecosystem, name, and version to package registries and OSV.dev. They do not include source code, file paths, project names, or organisation names. The package guard needs no account, so most people who use it never sign in. To know how often it runs, it sends an anonymous daily count of its checks for those users: the ecosystem, the verdict, which surface ran it (the agent hook, iris install, the MCP tool, the editor or a push) and, for a hook, which coding agent. Never a package name, version, path or project, and nothing that identifies you. The server stores daily totals only. These counts are sent only after you have allowed dependency lookups, and never when the DO_NOT_TRACK or IRIS_TELEMETRY=off environment variable is set; VS Code’s own telemetry setting also turns them off. Signed-in users report through their account instead, and the account’s analytics setting applies. The CLI asks before its first dependency lookup and remembers the choice in ~/.iris/preferences.json. Revoke consent at any time:

​
Workspace writes

Iris Code writes project files only after an explicit user action, such as:
  • generating or syncing .irisconfig.json
  • exporting an HTML report or CycloneDX SBOM
  • generating a CI workflow
  • locking a trend baseline
  • installing a pre-push or build hook
Trend snapshots stay in the project?s .iris-snapshots/ folder. Dependency caches stay on your machine under ~/.iris/cache/, where they can be reused across projects.

​
Credentials

The VS Code extension stores licence credentials with VS Code’s secret-storage API. The standalone CLI can store credentials under the user’s home directory and also accepts IRIS_LICENCE_TOKEN for non-interactive CI. Never commit a licence token to .irisconfig.json, a workflow file, or source control. Store CI tokens in your CI provider’s secret manager.

​
Report a vulnerability privately

Email hello@iriscode.co with [Security] in the subject. Include:
  • the affected surface and version
  • clear reproduction steps
  • the likely impact
  • a safe proof of concept, if available
Do not include live credentials, customer data, or source code you do not own. Reports are reviewed privately before public disclosure. Iris Code does not currently operate a paid bug-bounty programme.

​
General support

For bugs, account questions, billing, or help using Iris Code, visit iriscode.co/support or email hello@iriscode.co. Read the Privacy Policy for personal-data handling and the Terms of Service for service terms.