shkSecurity Harness Kit

Privacy Policy

This Privacy Policy (the "Policy") explains how the developer and maintainer of shk (Security Harness Kit), GitHub account Kazuki-tam (the "Operator"), handles information in connection with the shk CLI and shk Desktop (together, the "Software") and their documentation site (the "Site").

In short:

  • Scans, masking, and hook checks run entirely on your machine. None of them make a network request.
  • The Operator collects no telemetry about the Software: no usage statistics, crash reports, or identifiers. The Operator runs no server for the Software.
  • The Site has no accounts, forms, cookies, or analytics. The external providers used for hosting and font delivery may process technical access data.

1. Scope

This Policy applies to the Software and the Site. Information handled by external services the Software integrates with (GitHub, npm, 1Password, AWS, Google Cloud, AI coding tools, and so on) is governed by those providers' own privacy policies.

2. Information Handled by the Software

Processed locally

At your direction, the Software processes the following on your machine. None of it is sent to the Operator.

  • Files being scanned, Git history, and text passed on standard input
  • Prompts and documents being masked
  • File paths, prompts, commands, and similar data passed through AI coding tool hooks
  • The contents of MCP server configuration files

Stored locally

Depending on what you run, the Software stores the following on your machine.

  • The project configuration shk.toml and user-level configuration files
  • The hook audit log .shk/audit.log. It records metadata only: counts, tool name, hook phase, rule IDs, action categories, and display paths. It never stores matched values, prompt bodies, or command strings.
  • Reports and masked files you write to a location you choose. A report produced with --with-value-hash contains deterministic hashes of detected values, so treat it as a sensitive artifact.
  • dotenv private keys managed by shk env. By default they are stored in the OS keyring (macOS Keychain, Windows Credential Manager, Linux Secret Service, and so on); they can be stored in 1Password instead by configuration.

Keeping, sharing, and deleting this data is under your control. See Uninstall in the documentation for removal steps.

When network requests happen

The Software contacts external services only in the following cases, triggered by your actions or configuration. The providers involved may process technical details of those requests (IP address, timestamps, and so on) under their own policies. The Operator does not receive the contents of these requests.

  • Installation and updates. Installing through npm or bun, or running the installer scripts, downloads release archives from GitHub Releases or the npm registry.
  • Update checks. shk status and shk doctor version query GitHub to see whether a newer release exists. Scan and hook commands never perform update checks.
  • Desktop app. shk Desktop fetches updater metadata (latest.json) from GitHub to check for updates.
  • Secret store integrations. If you configure shk env to use 1Password, AWS Secrets Manager, or Google Cloud Secret Manager, the Software communicates with those services.
  • CI. GitHub Actions workflows generated by shk ci init run on GitHub.

3. Information Processed by the Site

What the Operator collects

The Site is a static documentation site. It has no account registration, contact form, or comment feature, and the Operator does not collect personal information such as names or email addresses through it. The Site sets no cookies and uses no analytics tools such as Google Analytics. Site search matches an index inside your browser; search terms are never sent anywhere.

Processing by the hosting provider

The Site is served on Cloudflare Workers, operated by Cloudflare, Inc. Cloudflare may process access logs (IP address, User-Agent, request time, request URL, response code, and similar) for delivery, security such as DDoS protection, and operational diagnostics. The Operator may view aggregate information and short-lived logs in the Cloudflare dashboard to investigate outages or abuse. See the Cloudflare Privacy Policy for details.

Web fonts

The Site loads fonts from Google Fonts, provided by Google LLC. When a page loads, your browser sends connection information such as your IP address to Google's servers. See the Google Privacy Policy for details.

The Site links to external sites such as GitHub, npm, and 1Password. Information handling on those sites is governed by their own policies.

4. Purpose of Use

Technical information the Operator may see while operating the Site is used only to:

  • provide and maintain the Site and respond to outages; and
  • detect and respond to abuse, excessive load, and other security issues.

The Operator does not sell or rent this information or use it for advertising.

5. Disclosure to Third Parties

The Operator does not disclose information about you to third parties except:

  • processing by the hosting and font-delivery providers described in Section 3, under their own policies;
  • where disclosure is required by law; or
  • where necessary to protect the rights, property, or safety of the Operator, users, or others.

6. International Processing

Cloudflare and Google operate globally, so the technical information described in Section 3 may be processed outside Japan.

7. Children

The Service is not directed at children, and the Operator collects no personal information, including age.

8. Your Rights

Because the Operator holds no information that identifies you as an individual, it may be unable to act on requests to access, correct, or delete information about a specific person. Data the Software stores on your machine can be deleted by you at any time. Contact the Operator through the channel in Section 11 with any questions.

9. Security

The Operator protects your information by keeping the Software designed so that it does not send data off your machine. If you find a vulnerability in the Software, report it privately by following SECURITY.md.

10. Changes to This Policy

The Operator may revise this Policy as the Software or the Site changes. A revised Policy takes effect when posted on the Site, and the last-updated date at the top of the page is updated. For significant changes in how information is handled, such as introducing telemetry, the Operator will make reasonable efforts to announce them on the Site or in the repository's release notes.

11. Contact

Questions about this Policy can be raised through the repository's GitHub Issues. Issues are public, so do not include secrets, credentials, or personal data.