Security and privacy
What Foo Guard stores, what it does not store, and how secrets are handled.
Repository scanning boundaries
Foo Guard:
- reads
.fooguard.yml(or legacy.agentguard.yml) - reads supported agent configuration files selected by scan paths
- analyzes at an exact commit SHA
- does not persist raw repository configuration
- persists safe scan summaries and structural finding location metadata
- does not persist credential values or secrets
GitHub installation tokens are short-lived, generated on demand, and not persisted in the browser or scan records.