Many teams want AI-assisted security analysis, but cannot send their repository to a third-party model by default. That is not an edge case. It is a normal requirement for private source code, customer data, regulated systems, and early-stage products that have not finished their data-flow review.
The solution is to separate deterministic checks from optional model-assisted analysis.
What can run locally?
A useful local baseline can inspect:
- secrets and credential-shaped values
- dependency manifests, lockfiles, and known CVEs
- MCP configuration and tool permissions
- agent instruction files and prompt-controlled command paths
- CI workflows and deployment settings
- common application security patterns
Run the baseline from the repository root:
~~~bash
npx ship-safe@latest audit . --no-ai
~~~
No provider key is needed for the core scan. The output can stay on the machine, be saved as SARIF, or be reviewed in a local terminal.
Decide where AI adds value
AI analysis is most useful when a deterministic rule has found a complex relationship that needs explanation, prioritization, or a proposed fix. It should be an explicit second step, not a hidden requirement for basic coverage.
Before enabling a provider, document:
1. which files or excerpts can leave the environment
2. whether secrets are redacted before analysis
3. which provider and region process the request
4. how long prompts and results are retained
5. whether the result is used for training
If those answers are not clear, stay in offline mode.
Avoid false privacy promises
"We do not train on your data" is not the same as "your source never leaves your environment." They are separate claims. A trustworthy security product explains the path for source, metadata, prompts, model output, logs, and stored history.
Ship Safe documents this boundary on its security and data flow page. The web app guide shows the hosted workflow separately from the local CLI workflow.
Make offline mode useful, not merely available
Offline scanning should have the same baseline rule IDs, severity model, evidence format, and exit codes as hosted scanning. Otherwise teams cannot compare local and CI results.
For CI, write a machine-readable report and fail only on the policy threshold you chose:
~~~bash
npx ship-safe@latest ci . --threshold 80 --sarif ship-safe.sarif
~~~
Keep the report complete. A scanner that returns a score but loses the underlying finding list is difficult to audit and difficult to trust.
A privacy-first operating model
- Run deterministic checks locally on every change.
- Redact secrets before any optional AI analysis.
- Make provider use opt-in and visible in the command or UI.
- Keep hosted history separate from raw source content.
- Give teams a way to delete stored scan artifacts.
- Make the same security boundary clear in docs, pricing, and onboarding.
This model lets a developer start with zero signup and zero API key, while teams can add hosted history and collaboration when they need it. That is a better conversion path than forcing a trust decision before a user sees a useful result.