Security and privacy
What Foo Guard stores, what it does not store, and how secrets are handled.
Page text and source link for your AI assistant. Nothing is sent automatically.
Repository scanning boundaries
Foo Guard:
- reads
.fooguard.yml(or legacy.agentguard.yml) - reads supported agent configuration files selected by scan paths
- analyzes at an exact commit SHA
- does not persist raw repository configuration
- persists safe scan summaries and structural finding location metadata
- does not persist credential values or secrets
GitHub installation tokens are short-lived, generated on demand, and not persisted in the browser or scan records.