Privacy.
Crowsnest runs on your machine. This page lists what leaves it, and when.
What stays on your machine
Your lockfiles, your results and Crowsnest's own data file stay where you run it. Crowsnest has no account system. To remove everything it stored, stop it and delete crowsnest.duckdb and the snapshots folder.
What can leave your machine
npm registry
The names of packages being looked up, up to 100 per scan. If you set NPM_TOKEN, it is sent to the npm registry as a bearer token. PyPI is not contacted during a scan.
During a scan, with or without keys.
OSV (api.osv.dev)
The names of packages being looked up for known vulnerabilities, up to 500 per scan.
During a scan, with or without keys.
Anthropic
When Crowsnest plans a scan: the project folder path, the kind of project, the time of the last scan, any recent campaign names and your GitHub organisation name. For each check that finds something, up to 20 result rows are sent too. Triage and remediation do not call Anthropic.
Only if you set ANTHROPIC_API_KEY.
Socket
Package names, up to 50 npm packages per scan.
Only if you set SOCKET_API_KEY.
GitHub
Repository and maintainer lookups.
Only if you set GITHUB_TOKEN.
Slack
The posts the bot makes to the channel you choose.
Only if you run the Slack bot.
Without keys
The optional calls to Anthropic, Socket and GitHub are not made. A scan still looks up package names on the npm registry and OSV, as listed above, and Crowsnest uses cached data for the rest.
Usage data
Crowsnest sends no usage data to its authors.
This website
This website counts page views with Vercel Web Analytics. It sets no cookies and does not follow you from site to site. Crowsnest itself, on your machine, has no analytics.
Questions
Ask on GitHub issues. There is no contact email.
You decide which keys to add. Each key adds only the call listed above.