Cefense reads source code, which makes this the page that matters most to a security reviewer. It is written to be checkable rather than reassuring.
What Cefense reads
The contents of a connected repository at the commit being scanned, fetched through the provider API using the credential you granted. Nothing outside repositories you explicitly connected is read, and connecting an account on its own does not read any code.
The CLI reads your local git remote to work out which repository a directory corresponds to. It does not read, upload, or scan your working tree.
What is stored
| Stored | Why |
|---|---|
| Findings, and the vulnerable code region each one covers | A finding is not reviewable without the code it is about |
| The traced data flow, with file and line references | It is the evidence for the finding |
| Generated patches, as a diff and as the patched file content | So publishing costs nothing extra and a patch survives the branch moving on |
| Component inventory from your manifests and lockfiles | Dependency vulnerability lookups and SBOM export |
| Scan metadata: commit SHAs, branches, timestamps, statuses | History and reconciliation |
| Provider credentials, encrypted | Fetching the code you asked to be scanned |
Credentials
The CLI stores its access token in your operating system keychain: the macOS Keychain, Windows Credential Manager, or the system keyring on Linux. Where no keyring is available it falls back to ~/.cefense-cli/credentials.json with owner-only permissions, and tells you it did so.
Signing in uses OAuth2 with PKCE through your browser. There is no API key to paste, no client secret shipped in the package, and no endpoint baked into the binary. In CI, set CEFENSE_TOKEN in the environment: it is read directly and never written to disk.
What Cefense writes to your repository
- During a scan: nothing at all. Scans are read-only.
- When you publish a fix: one branch, one commit on it, and one pull request.
- When you merge a fix: the merge, through the provider's own API, respecting branch protection.
cf skill installwrites agent instruction files into your working tree locally. Those are ordinary files for you to review and commit.
Deleting your data
Deleting your account revokes the provider OAuth grants, removes the GitHub App installation, and deletes the account row. An organization you were the last member of is deleted with it, and everything it owned goes too: the provider connections, the connected repositories and images, every scan and all of its findings, fixes, and matches, the audit trail, and the workspace profile.
An organization that still has other members is somebody else's live workspace and is left alone. One person closing their account must not delete their colleagues' work, so what goes is your membership, not the team's repositories.
Two things are deliberately kept, and neither points back at you. Analysis results keyed by file content, held per organization, which is what makes an already-analysed file free for the rest of the team to scan again, and the shared security research corpus, which was never your data.
External steps are best effort and never allowed to block the delete. A provider outage must not be able to leave your data sitting in the database.
Reporting a vulnerability
Have a correction or need help?
Email the docs team