Project file security

Your project stays on this device during a normal scan.

Halden reads the local project folder you choose. Source files, environment values, and detected API keys are not uploaded for the normal scan.

Account access, updates, GitHub checks, and dependency audits use separate network paths for specific purposes.

What stays on this device

Normal scanning and its project data remain separate from Halden's web account service.

Processed locally: Source files, environment values, detected API key values, scan results, and suggested Fixes are processed on this device.
Stored locally: Registered project paths and redacted scan caches stay in Halden's local app data. The refresh token and random install device identifier use the operating-system keychain.

These requests are separate from the normal project scan. Each has a specific trigger and a limited data purpose.

Account & license: WhenWhen you sign in or Halden checks account access.
Shared dataAccount session, license request, and desktop device metadata.
App & pattern updates: WhenAfter startup and during scheduled update checks.
Shared dataApp target, architecture, and version information, plus signed pattern-manifest requests. No project files are included.
GitHub Secret Scanning: WhenOnly when you explicitly run the GitHub check for the selected project.
Shared dataThe GitHub repository owner and name.
Dependency audit: WhenWhen you choose to run the dependency audit.
Shared dataYour local package manager may send package metadata to its configured registry.
Checkout & account Dashboard: WhenWhen you open the web Dashboard or start checkout.
Shared dataAccount, license, and payment-processing information.

Halden validates the registered project and current change before it writes. A project file changes only after one of these actions.

Individual Fix: Applies the supported Fix you reviewed.
Environment save: Writes the detected environment file you edited.
Pre-commit protection: Installs or removes Halden's protection hook for that project.

Detection: Halden checks known API key patterns and local setup gaps. It cannot guarantee that every secret or every published copy will be found.
External follow-up: Halden does not rotate provider credentials, rewrite Git history, or force-push. If a credential may have been exposed, rotate it with the provider and review Git history and other published copies separately.

Starter includes 1 local project and the complete Halden workflow.