Nitpick handles production log entries, which routinely contain user data. Today the SQLite cache retains every sample log indefinitely, and there is no documented statement of what leaves the machine.
Scope
- A configurable retention window for sample logs, with a documented default, so raw log content is not kept indefinitely by accident.
- An explicit, testable redaction step applied before log content is stored or sent to any provider.
- A short document stating exactly what is sent where: what reaches the agent backend, what reaches the tracker and doc sink, and what stays local.
Why it matters
This is the first question a security reviewer asks, and the honest current answer -- sample logs persist forever in data/error_cache.db -- is a blocker for teams whose logs are the most sensitive. It is also the group Nitpick's local-first design is most suited to.
Done when
Retention is configurable and enforced, redaction is covered by tests including a case with credentials in a log line, and the data-flow document is linked from SECURITY.md.
Nitpick handles production log entries, which routinely contain user data. Today the SQLite cache retains every sample log indefinitely, and there is no documented statement of what leaves the machine.
Scope
Why it matters
This is the first question a security reviewer asks, and the honest current answer -- sample logs persist forever in
data/error_cache.db-- is a blocker for teams whose logs are the most sensitive. It is also the group Nitpick's local-first design is most suited to.Done when
Retention is configurable and enforced, redaction is covered by tests including a case with credentials in a log line, and the data-flow document is linked from
SECURITY.md.