Privacy

The CLI and dashboard do not contact a remote service. Network activity can only happen in two cases: a command you run with evd watch uses the network, or evd rollback --apply runs a package manager that downloads something.

The local store

<store>/
  config.json          settings, retention, and the per-store salt
  db.sqlite            snapshots, runs, cases, baselines, rollbacks, events
  objects/             compressed snapshot and config blobs
  logs/                local operational logs

The default location is %LOCALAPPDATA%\Envidence on Windows and $XDG_DATA_HOME/envidence or ~/.local/share/envidence on macOS and Linux. Use --store or ENVIDENCE_HOME to choose a different directory. See Configuration.

A report created with evd report is a separate HTML file. Reports are self-contained and have no remote assets.

What a snapshot can contain

Environment values and secret-like names

Envidence stores variable names and, for ordinary variables, values. Values whose names look secret-like are handled differently:

• The raw value is not stored.
• A salted SHA-256 hash is stored so changes can still be detected.
• A short masked preview is stored for recognition. Values longer than four characters show the first two and last two characters. Shorter values show ****.
• The salt is generated per store in config.json.

The name check is heuristic. It catches forms such as TOKEN, SECRET, PASSWORD, API_KEY, AUTH, CREDENTIAL, PRIVATE_KEY, SESSION, and COOKIE. A secret stored in a variable with an ordinary name is not automatically hashed. Known token shapes and URL credentials are stripped from reports, but the original snapshot value may remain in the store.

Config files

Only a fixed candidate set is read: Git config, .npmrc, Cargo config, shell profiles, .editorconfig, pip config, VS Code user settings and keybindings, the hosts file, and a handful of project-local tool configs. This is not a general file crawler.

For a readable config file up to 256 KiB, secret-looking assignment lines are replaced, known token shapes are stripped, the redacted text is stored as a gzipped blob, and a hash of the original file is stored. Files that needed redaction are marked restorable: false.

Binary files and files over 256 KiB are hashed but their content is not stored. SSH private keys, cloud credential directories, browser profiles, cookies, and keychains are not collector candidates.

Project scanning

Project collection is scoped to the current project root. It stores manifest and lockfile hashes, package dependency names and scripts, environment variable key names, environment variable references and line numbers, likely ports, Compose services, and config hashes. It does not store source file contents.

The scan skips node_modules, .git, dist, build, and other dependency or output directories. It does not read personal document folders or browser profile data.

Command output

evd watch stores the command, its arguments, exit code, timestamps, and bounded tails of stdout and stderr. Output can contain paths, usernames, internal hostnames, or secrets printed by the command. Known token shapes are removed by report redaction. If you do not want output retained, use the default bounded capture and do not pass --capture-output.

Closing a case does not delete the underlying run. Commands that print secrets should not be run under evd watch unless you accept that risk.

Network

• No telemetry endpoint, crash reporter, update check, analytics SDK, CDN, remote font, or remote image.
• No LLM or network-based inference.
• No account or login from the CLI.
• evd report --open and evd ui open local browser pages.
• evd rollback --apply may run package managers, with their own network and lifecycle scripts.

Retention and deletion

The default policy keeps 50 snapshots and snapshots younger than 30 days. Pins, baselines, snapshots referenced by runs or cases, and safety snapshots are protected.

evd prune
evd prune --keep 30 --days 14 --yes

To delete the entire local evidence store:

# Windows, project-local store
Remove-Item -Recurse -Force ./.envidence

# Windows, default store
Remove-Item -Recurse -Force "$env:LOCALAPPDATA\Envidence"

# macOS and Linux
rm -rf ./.envidence
rm -rf "${XDG_DATA_HOME:-$HOME/.local/share}/envidence"

Deleting the store is irreversible and removes the evidence needed for evd why, evd case show, and rollback. Delete generated reports separately.

Sharing a report

Use standard or strict redaction before sharing:

evd report --case CASE-... --out case.html --redact strict

none is for local viewing. It keeps paths, host and user names, project identifiers, and non-secret values. Even with none, secret-marked values and recognized token shapes are redacted, but that is not a guarantee that the report contains no sensitive information.

Read Security before sharing a report outside your machine.