What leaves your CI

The analysis runs in your workflow, on your runner. Your code never leaves it. What leaves is a report of numbers, file paths and commit SHAs, sent to coderot over HTTPS.

Your CI

The coderot Action reads your repo and its history here. These stay here:

source code and diffs
comment text
commit messages
names and emails

a report over HTTPS

coderot, in the EU

Receives metrics, file paths and commit SHAs, checks them against the report's schema, and shows them to your org's members.

What a report holds

Sent to coderot	Never sent
Per function: its name, kind, first and last line, and its metrics (complexity, lines, parameters, nesting)	Source code, diffs or code snippets
Per file: its path, its git blob SHA, its lines of code, where its comments are, as line numbers and kind (line, block, doc), and the lines that failed to parse	Comment text
Duplicated code, as locations: path and line range of each copy	The duplicated text itself
How many files were left out as generated, vendored or excluded, and how many files and lines of markup weren’t measured, per file type	Secrets or environment variables
Which agent instruction files exist (`AGENTS.md`, `CLAUDE.md` and the like), by path	Their contents
Per commit: its SHA and date, lines added and deleted per file, whether it changed an agent instruction file, whether it’s a fix, and which earlier commits a fix repaired or a revert reverts	Commit messages
Per commit: which AI agents left a signal on it, and with Git AI, how many lines each wrote per file	Prompts or agent conversations
Per commit: a hash of each human author’s email (below)	Names or email addresses
Per PR: its number, files and lines changed, and commit count	PR descriptions
Per PR: how many people reviewed it, whether one approved, how many comments people and bots left, and how long it took from ready for review to merge	Who reviewed it, or what anyone wrote
PR titles, only with `titles: true` in the workflow (configuration)	PR titles, by default

Paths and function names are sent as they are, because every screen points at a folder, file or function.

Author hashes

The dashboard never needs a person’s name: it links each PR to GitHub, where you see who wrote it. To count active contributors, a run sends a SHA-256 of each human author’s email (lower-cased, and with GitHub’s numeric noreply prefix taken off, so one person counts once). Agents and bots are dropped in CI.

Before anything is stored, coderot hashes each one again with a secret key of your org’s own. So nobody who reads the stored data, us included, can test a known email against it or match a person across orgs.

Review counts

Review counts come from GitHub’s API inside your run, with the workflow’s own token (pull-requests: read). The run uses reviewers’ logins to tell people from bots and from the PR’s author, then sends only the counts.

Check it yourself

The coderot CLI is what the Action runs, and its code is in the npm package. Run it in a full clone of your repo:

npx @coderot-ai/cli analyze --out report

It writes the report to report/ and sends nothing: one JSON file per snapshot and commits.json. Add --titles if your workflow sets titles: true.

On your machine it skips what needs GitHub’s API: each PR’s review counts, and the commit count of a squash-merged PR. To include them, give it a token that can read the repo’s pull requests and the repo’s name, as the workflow does:

GITHUB_TOKEN=$(gh auth token) GITHUB_REPOSITORY=owner/repo npx @coderot-ai/cli analyze --out report

With both set, report/ holds the same report the workflow’s first run sends.

coderot’s API rejects any upload that doesn’t match the report’s schema, so a field outside this list can’t be stored.

Pull requests

On a pull request, nothing leaves your CI for coderot. The Action measures the files the PR changes, at its base and at its head, and posts the numbers as a comment on the PR with your workflow’s own token: cognitive complexity per file, the functions that rose most, the lines changed and the hotspots it touches. The comment lives on GitHub, like any other.

How uploads are accepted

There’s no secret in your repo. Each upload carries the OIDC token GitHub issues to the workflow run, and coderot checks it against GitHub’s keys, then accepts it only when:

the token is for a repo added to a coderot org, by GitHub’s repo id, not its name,
the run is on the repo’s default branch, so a pushed branch can’t replace its history.

Where it’s stored, and who sees it

Reports are stored in the EU: the API runs in Western Europe, the database in Frankfurt, and the uploaded files in Cloudflare’s EU storage. Everyone in your coderot org sees the reports of its repos, and nobody else, unless you turn on a public repo’s public page. The privacy notice lists every company involved.

What the GitHub App can see

Signing in uses coderot’s GitHub App, whose only permission is read-only Metadata: repo names, visibility, default branch, and your role in each repo. It can’t read code, issues or pull requests. coderot uses it to check that you administer a repo before you add it.

Deleting it

Settings → Remove on a repo deletes its data, including every uploaded report. To delete your account, email [email protected].