the data boundary

Scanning is local. Two stages are not. Here is the line.

Patchward runs in your environment, under your credentials, against your repository. Static analysis never leaves the sandbox. Two stages — triage and fix generation — do call out, and this page marks exactly where and with what.

The crossing point, drawn.

■ inside your environment — network-isolated

semgrepbanditpip-audittrivyeslint

Docker sandbox, default-deny egress. Most scanners run fully offline; dependency auditors get a narrow allowlisted exception to reach their vulnerability databases — they send package names, not your source.

▼ crossing point — repository file contents leave your environment here ▼

■ outbound — the anthropic api, called from your environment

triagereviews scanner findings; may read additional files for context

fix generationreads the relevant file before editing it, or declining the fix

// both stages can read any file in the scanned repository, not only the flagged lines — a deliberate design choice so the model has enough context to produce a correct fix.

the canonical statement

Said once, in one place, dated.

The triage and fix-generation stages send repository file contents to the Anthropic API to do their work. Credential scrubbing applies to Patchward's own CLI output and logs — not to what is sent to Anthropic.

verified 2026-08-11 · source: credential_proxy.py / fix_gen.py source trace, build doc D11

scrubbing · what it covers and what it doesn't

The boundary is drawn at the container, and we say so.

covered

API keys and repository tokens are loaded once into a credential proxy and structurally excluded from every scanner container's environment, re-checked by a runtime assertion before each container starts. Scanner finding messages are scrubbed to[scrubbed] before reaching logs or CLI output — a visible placeholder, so you can see the scrubbing happened.

not covered

Text generated by the triage or fix-generation stages is not covered by that scrubbing. Neither is what those stages send to the Anthropic API — scrubbing protects Patchward's own local output, not the outbound request. This is the distinction most security pages blur; it is the reason this page exists.

If this boundary is the wrong shape for your repository, say so early.

Zero Data Retention arrangements and processing agreements exist and can be put in place before any engagement rather than after. The honest version of this conversation is cheaper to have up front.

Ask about the boundary →