How Saer handles your code

What Saer reads

Saer reads source and style files (.ts, .tsx, .js, .jsx, .css, .scss) and Tailwind configs as text, plus the package.json files and lockfile it needs to find your workspace packages and the Tailwind version you installed. It never executes your code or scripts and never installs your dependencies. .env files, credentials and certificates are not scan inputs. Tool caches, dependencies and Git metadata are skipped; generated or vendored code cannot establish an authored finding by itself.

Source selection follows .gitignore files in each analysed root and beneath it, including nested rules and negation. Global Git configuration and rules outside those roots are not read. These scan rules also apply to tracked files. Linked files and folders are not followed. A file excluded by these rules is not checked: explicit agent or CI checks report that limit rather than calling it clean.

To deliberately scan a project stored inside an ignored or cache-named folder, point Saer at the project folder itself. Parent folder names do not empty that scan. If ignore rules are unreadable or exceed the supported size, Saer stops without replacing the previous report. No Git executable is needed to interpret ignore rules.

What Saer writes

Only the report, inside .saer/ in the directory you scanned, or wherever --output points.

Network use

• Free scans run offline. Premium scans and MCP tools make online account checks containing your sign-in credential and a fresh request nonce. Repository paths, code, findings and prompts are not included. Updated premium launchers also read your optional usage preference; they send no usage event unless you enable it.
• Optional cloud projects store your project label and explicitly reviewed summary counts. Source code, paths and token values are refused. See cloud history.
• saer audit-url: fetches the public website you give it, as SaerBot, politely. See SaerBot.
• Beta premium access uses email sign-in, accepted terms and one connected CLI installation. The installer downloads a verified compiled build. Signing out revokes the CLI session; free scanning remains available.

Optional workflow measurement

This is off by default and separate from marketing and cloud-history uploads. In your beta account, expand Optional product usage measurement to review and save your choice. Updated launchers can share only the UTC day of a successful full scan, a completed CI check or an agent report refresh. No project content or tracking identifier is sent.

We keep at most one of each workflow per account per day for 90 days. Turn the setting off to erase these days. Owner, test and unclassified accounts are excluded from customer metrics. An agent report refresh does not establish that the agent completed your task. See privacy.

Determinism

There is no model at scan time. The same code gives the same findings on every run and every supported machine.