Skip to content

Security and Privacy

PostQ Code Scanner processes source and writes reports on the machine or runner where it is executed. Enterprise deployment should treat source, findings, reports, license files, and local usage state as distinct protected assets.

Data flow

The deterministic path reads selected source, runs the local OpenGrep process, loads packaged rules and metadata, and writes reports to the configured output directory. Offline license validation does not contact a PostQ service.

Version 0.1.0-beta performs deterministic local analysis and does not provide an external analysis integration.

Protect the source tree

  • Grant the scan account read access only to source in scope.
  • Mount source read-only for container scans.
  • Exclude secrets, private keys, generated credentials, and unrelated regulated data from scan scope where practical.
  • Run scans on trusted workstations or isolated CI runners.

Protect reports

Reports can contain repository names, source paths, code excerpts, algorithms, parameters, vulnerabilities, and remediation guidance. Apply access control, encryption, retention, and secure deletion appropriate for sensitive engineering and security data.

Avoid attaching complete reports to public issues or unprotected email. Share the minimum evidence needed for support and redact unrelated source.

Protect licensing state

  • Store postq.lic in an approved secret or configuration location.
  • Do not commit, paste into logs, embed in images, or distribute with reports.
  • Preserve and protect the local usage ledger; do not edit or reset it.
  • License content and ledger data are not included in generated scanner reports.

Container supply-chain controls

Use registry permissions, platform-specific images, digest pinning, supplied SBOM/security evidence, and signature verification where available. Runtime hardening does not prevent inspection by an actor with access to the image archive or registry content.

Support evidence

When diagnosing a problem, collect product version, operating system, OpenGrep/Java versions, redacted command options, exit code, scanner logs, and manifest.json. Do not send a license file, private source, or raw report unless the approved support process explicitly requires and protects it.