Privacy

Rust Doctor runs entirely on your machine. No network, no upload, no telemetry.

Rust Doctor never reaches the network. There is no HTTP client in the binary, no analytics dependency, and no phone-home path to enable. This is not a default you can flip: it is the absence of the capability.

#What the scan touches

Rust Doctor reads the workspace you point it at. It parses source text, reads Cargo.toml, Cargo.lock and .cargo/config.toml, asks git which files are tracked, and runs cargo clippy inside the workspace. Everything it learns stays in the process that learned it.

The one file it can write is .github/workflows/rust-doctor.yml, only when you pick that entry from the interactive report's menu, and never over an existing file.

#The trust boundary

Because a scan runs cargo clippy, Cargo executes that workspace's build.rs files and procedural macros. Inspect local paths you trust. Do not scan a workspace you received from an issue, a bug report, or any source outside your own control.

The four native producers compile nothing: they parse source text, read manifests, and ask git what it tracks.

#The JSON report

--json prints a report whose paths are workspace-relative. It carries no absolute path, no environment variable, and no user data, so it is safe to attach to an issue or feed to an agent.

#Sharing

The report can print a share link. The link encodes only the score, the error, warning and info counts, and the number of source files scanned, as query parameters that the page decodes. Nothing is uploaded: the URL is the payload, the viewer is stateless, and no report is stored anywhere.

Building the link requires an authoritative score, so a scan whose passes did not all complete prints no link rather than a link that means less than it appears to.