Data Handling

What scan reads

scan requests repository, pull-request, commit, contribution, profile, organization, and optional profile README fields for the requested login through authenticated GitHub GraphQL queries.

Those queries have no public-only visibility filter. Results follow whatever the token is allowed to see, and can include private or internal-visible repository and pull-request data. Use a least-privilege token and confirm its visible scope before scanning.

What scan writes

The default raw directory is out/LOGIN/raw/. It can contain:

• repos.jsonl
• prs.jsonl
• commits.jsonl
• contributions.json
• user_info.json
• profile_readme.md (optional)

Treat every generated file as sensitive local data. Records can contain identifiable author metadata and material derived from private or internal-visible sources.

What report writes

report reads those raw files and writes profile.json, top_repos.json, and chart files below out/LOGIN/. narrate can add a prompt file or a generated narrative in the same per-user directory.

Retention and removal

The fixed source does not enforce a retention schedule. As the operator, you need to:

1. Choose a purpose for collecting the data.
2. Use a least-privilege token.
3. Limit access to the output directory.
4. Avoid committing generated per-user output.
5. Remove raw, derived, prompt, and narrative files when that purpose ends.

External transmission

Scanning sends queries to GitHub. AI narrative generation sends profile-derived prompt material to the configured provider only when an API key is present. Review the prompt and the provider's terms before enabling that path.

Issue reporting state

Use Report issue for reproducible documentation problems. Include the command, runtime version, and a redacted error. Never attach raw user records, prompts, or credentials.

The source retention note explains that removing current files does not erase Git history.