pkgscan.dev · Documentation

Privacy and scan data on pkgscan.dev

pkgscan scans public software, and its results are public by design. That has consequences for what you should submit. This page summarises the data model; the binding document is the privacy policy.

Updated 2026-11-05

What is stored

• Account data. If you sign in with GitHub or Google: email, name, profile image URL, provider name, and provider account id. pkgscan never receives your provider password.
• Scan data. Package identifiers, the artifact, file name and size, SHA-256, scan status, per-engine verdicts, and findings.
• Billing data. Subscription tier and Stripe customer references. Card details are handled by Stripe, not pkgscan.

Why scan results are public

A package verdict is only useful if the next person can find it. Public reports also mean a scan is never wasted: a report you paid for answers the same question for everyone else. The consequence is that anything you upload can become public. Do not submit private source code, credentials, internal hostnames, or personal data. If you need to check a private artifact, scan a build that does not contain secrets.

Analytics and consent

Google Analytics loads only after you accept analytics in the cookie banner. Declining keeps the analytics script from loading. You can change the choice later from the cookie settings in the footer.

Deleting your data

You can delete your account from Settings, or by calling the account deletion endpoint. Account data is removed; public scan results may be retained because they describe a package rather than a person. For a specific request, contact [email protected].

Full policy: pkgscan.dev Privacy Policy. Terms: Terms of Use.

Check a package or file now: scan it on pkgscan.dev.