Local code security scanning with auditable entitlement checks.

Code Radar is designed for teams that need private code security scan evidence without sending source code to another hosted scanner.

Direct answer

Local Scanner Security Model

Review Code Radar security controls for local code security scanning, no-source-upload SAST, license validation, telemetry metadata, and CI enforcement.

Install docs CI docs

Does Code Radar upload source code?

No. Source code, snippets, secrets, reports, and repository archives are not uploaded by Radar. Scans run in the local workspace or GitHub Actions runner.

What metadata can leave the environment?

Entitlement checks, machine or repository fingerprints, plan status, client version, optional telemetry, and checkout attribution can leave the environment; repository contents do not.

How does CI preserve the boundary?

GitHub Actions scans run in the runner. Paid CI validates repository slots and entitlement online, while SARIF, JSON, HTML, and terminal outputs are written where the command runs.

What should security buyers inspect next?

Inspect the privacy page, telemetry controls, report formats, and GitHub Actions setup before adding Radar to private repositories or paid CI gates.

Intentanswer local code security scanner, private code security scan, and no source upload SAST trust objections

Proofsource code not uploaded by Radar, metadata-only entitlement checks, CI runner scan boundary, report ownership, and telemetry controls

Next actionreview privacy and telemetry docs, then install Radar only after the source-handling model fits the private repository workflow

Decision evidence

Trust proof before private-code rollout.

Security buyers need explicit evidence about where code is read, what metadata leaves the environment, and which controls protect paid workflows.

local code security scanner

Code Radar is designed around scanner execution in the local workspace or GitHub Actions runner.

Evidence to inspect: Source code, snippets, secrets, reports, and repository archives are not uploaded by Radar.
Boundary: Entitlement checks and optional analytics can use metadata, but source content is outside the normal product telemetry boundary.

Read privacy boundary

private code security scan

Private repositories should evaluate the source-handling model before CI rollout.

Evidence to inspect: Report ownership, metadata-only licensing, telemetry opt-out, and GitHub Actions runner-local scanning.
Boundary: Do not add a paid CI gate until the team accepts which metadata leaves the environment.

Read CI docs

no source upload SAST

The trust proof is operational, not a slogan: commands and reports run where the code already lives.

Evidence to inspect: Install docs, local scan output, report formats, privacy telemetry docs, and security controls.
Boundary: Radar should not claim certifications or enterprise attestations that are not documented on the site.

Install locally

Trust proof

Prove the scanner without moving source code into another system.

Security buyers need a clear boundary before they install a scanner on private repositories. Radar keeps scan execution local or inside the GitHub Actions runner while licensing and telemetry use metadata only.

Run local scan Review privacy

SourceStays localRepository files are read where the command runs.

EvidenceReports stay yoursSARIF, JSON, HTML, and terminal output are written to requested paths.

LicenseMetadata checksEntitlement validation uses license and activation metadata, not source content.

CIRunner scopedGitHub Actions scans inside the repository runner and consumes repo slots.

radar scan . --quick
radar scan . --format sarif --fail-on high
radar license status

This page should convert trust-sensitive searches for private code security scan, local code security scanner, and no-source-upload SAST.

Trust objection router

Turn source-handling concern into a concrete proof path.

Security-sensitive visitors need the boundary first, then the next action. Route them to local scan proof, privacy details, CI validation, or pricing only after the trust question is answered.

Will Radar upload source code?

No. Scans run in the local workspace or GitHub Actions runner, and reports are written where the command runs.

no source upload sastprivate code security scanlocal code security scanner

Review privacy boundary

What metadata leaves the machine?

Entitlement and optional telemetry metadata can leave the environment; source text, snippets, secrets, reports, and repository contents do not.

scanner telemetry privacylicense validation metadataoffline code scanner

Read telemetry docs

Can CI enforce the same boundary?

GitHub Actions scans inside the runner and consumes repository slots when a paid plan validates CI usage.

github actions security scannerthird party code scanning tool githubsarif scanner

Review CI gate

Trust evidence checklist

Verify the local-first claim before rollout.

Security-sensitive buyers need evidence they can inspect before a scanner touches private repositories. Use this checklist to move from trust concern to a controlled local scan, CI gate, or pricing decision.

Source stays in the scan environment.

Normal scans read repository files where the command runs: a developer machine or GitHub Actions runner.

Review privacy boundaries before installing on a sensitive repository.

no source upload sastprivate code security scanlocal code security scanner

Review privacy

Reports stay where the workflow writes them.

SARIF, JSON, HTML, and terminal output are local artifacts unless the workflow explicitly uploads an artifact.

Inspect report formats before deciding which artifact belongs in review.

sarif scannerhtml code security reportjson security scan report

Inspect sample report

CI runs inside the repository runner.

GitHub Actions validation consumes repository slots and runs in the runner environment instead of a hosted scanner workspace.

Use CI only after the local signal is trusted and the team wants shared enforcement.

github actions security scannerthird party code scanning tool githubrepository security gate

Review CI boundary

Purchase follows proof.

Free Preview proves a local quick scan; paid plans unlock full local scans, reports, MCP workflows, and repository gates.

Move to pricing only when the evidence answers the team's trust concern.

free local sastdeveloper first sastteam sast pricing

Choose plan boundary

What leaves the machine

This is the security contract the product should be judged on. Source code stays where the scan runs; entitlement and attribution metadata go to the licensing backend.

Source codeNot uploaded by Radar. Scans run in the local workspace or GitHub Actions runner.

License keysStored server-side as HMAC hashes. Raw keys are not persisted in database rows.

Machine identityHardware-derived component hashes are sent, not raw hardware identifiers.

TelemetryMetadata-only events for attribution and product usage. No source paths, source snippets, secrets, reports, or repository contents.

CI validationGitHub Actions validates online on each run and consumes repository slots for paid CI plans.

ReportsSARIF, JSON, HTML, and terminal output are written only where the command runs.

Controls against free usage and shared-key abuse.

Radar cannot be impossible to crack, but the production design raises the cost: server-side validation, signed entitlements, database-backed plan limits, rate limits, and separate local/CI slots.

Fail-closed entitlementPaid commands require online validation. Expired, revoked, or over-limit licenses do not silently continue.

Slot abuse controlMachine and repository limits prevent one key from becoming unlimited installs or CI usage.

Rate limitingActivation, validation, checkout, and analytics endpoints use server-side rate limits and abuse logging.

Paddle/AppSumo separationPayment and redemption providers feed the licensing backend; plan limits stay in database records.

Telemetry is optional.

CLI telemetry supports product health and launch attribution, but it must not be required for source scanning. Users can opt out with standard environment controls.

Disable CLI telemetryDO_NOT_TRACK=1 or RADAR_TELEMETRY=0

Privacy detailsReview what metadata leaves the machine and what never leaves the scan environment.

Local scanner security FAQ

Does Code Radar upload source code?

No. Source code, snippets, secrets, reports, and repository archives are not uploaded by Radar. Scans run in the local workspace or GitHub Actions runner.

What metadata can leave the environment?

Entitlement checks, machine or repository fingerprints, plan status, client version, optional telemetry, and checkout attribution can leave the environment; repository contents do not.

How does CI preserve the boundary?

GitHub Actions scans run in the runner. Paid CI validates repository slots and entitlement online, while SARIF, JSON, HTML, and terminal outputs are written where the command runs.

What should security buyers inspect next?

Inspect the privacy page, telemetry controls, report formats, and GitHub Actions setup before adding Radar to private repositories or paid CI gates.

Need the operational path?

Start with a local security review tool, then add MCP and GitHub Actions only when your workflow needs shared enforcement.

Install docs GitHub Actions docs Local security review