tsc-git-hook / docs / data handling

Data handling and privacy

tsc-git-hook is designed to scan repository content locally on the developer workstation. The backend is used for authentication, repository authorization, operational telemetry, and detection workflow support, not for collecting raw repository content.

Latest stable: 2.0.5 ยท manifest updated: 2026-08-05T00:52:47Z

What stays local

  • Repository file contents are read and scanned locally by the CLI.
  • Raw secret values are not sent to the backend.
  • Ignore evaluation through .tscignore is handled entirely on the client machine.
  • The managed pre-push hook only invokes the local CLI and does not upload file blobs.

What the backend may receive

  • Repository context such as host, organization, and repository name for authorization decisions.
  • User-session and repository-authorization requests during login and session validation.
  • Execution telemetry such as CLI version, machine hostname, platform, runtime, counts, duration, and success state.
  • Detection events with masked values and fingerprint material used for deduplication and workflow operations.

Secrets are masked before reporting

When a detection is reported, the CLI does not transmit the raw secret value. The backend receives a masked representation and stable fingerprints that support deduplication and workflow state, such as acknowledgment or false-positive approval, without requiring the original secret to leave the workstation.

example raw secret: ghp_abcdefghijklmnopqrstuvwxyz123456 reported form: ghp_****************************3456

Execution telemetry

The CLI can report operational telemetry for pre-push and dry-run executions. This supports rollout visibility, troubleshooting, and aggregate activity views in the product dashboard.

  • execution mode
  • CLI version
  • machine hostname
  • operating system, architecture, and runtime
  • files scanned, ignored, findings emitted, approved, blocked
  • duration, success, and failure reason

Authentication data

The CLI stores a local session on the developer machine and exchanges that session for repository authorization when needed.

  • The browser-based sign-in flow uses a local loopback callback.
  • The backend keeps refresh-token and authorization state required for the GitHub-backed auth flow.
  • The current repository must still be authorized even when the user session is valid.

Operational boundaries