Local by default
Local scans with no account or telemetry
A normal scan does not create a network client. Source files stay on the machine. Network access is available only when you explicitly enable an active or OSV check.
Local input, local report
- IN Repository filesBounded reads below the project root.
- CPU Local Rust engineStatic rules run on your machine.
- OUT Actionable findingLine, confidence, and framework-specific fix.
What the default run does
The default command reads files below the project root, parses them, and prints a report. It does not create a network transport. The request budget is zero and the scope resolver denies every destination.
The two ways to opt in
| Flag | What leaves the machine |
|---|---|
--osv | Package names and versions from your lockfile, to api.osv.dev. Never source, never file paths. |
--target URL | HTTP requests to the URL you name, and only to its origin unless you widen --scope. Passive methods unless you also pass --allow-active. |
For an air-gapped pipeline: owlwarden osv update builds a cached
index once, and --osv-db path --offline fails closed if the cache
is missing rather than quietly reaching for the network.
What "no telemetry" means here
There is no analytics code, crash reporter, or version check. This site also loads no font CDN, analytics script, or tag manager. The site build checks the external-host allowlist.
Where it runs
A Rust engine behind a Node CLI, plus a standalone binary that needs no JavaScript toolchain at all. Both read the same rules and print the same report. In CI, the exit code is the gate and nothing is uploaded unless you upload it.
Keep reading
- owlwarden turnWhich of these did I just do?
- RulesTrigger, confidence, and framework-specific fix.
- Agent configHooks, MCP servers, instructions, and editor tasks.
- owlwarden vetCheck a repository before you open it.
- owlwarden sealNotice when your agent's execution surface moves.
- ExposureWhich of these findings do I fix first?
- RuntimesDoes this fix run on Bun, Deno, or Workers?
- CoverageMapped rules and categories static analysis cannot cover.