@nodatachat/guard

NoData Guard — Continuous security scanner that runs locally. Your data never leaves your machine.

Guard scans your codebase and (optionally) your database for security issues: exposed PII fields, missing encryption, unprotected routes, hardcoded secrets, and known CVEs. It generates two reports:

• nodata-full-report.json — Full details, stays local on your machine
• nodata-metadata-only.json — Metadata only (table names, counts, scores), sent to NoData for dashboard tracking

You can diff the two files to verify no data values were sent.

Quick Start

# Run directly (no install needed)
npx nodata-guard --license-key NDC-XXXX-XXXX-XXXX

# With database scan (Business Pro+)
npx nodata-guard --license-key NDC-XXXX --db postgres://user:pass@host/db

# CI/CD mode — fail on critical findings
npx nodata-guard --license-key $NDC_LICENSE --ci --fail-on critical

Features

| Feature | Free | Business | Business Pro | Enterprise | |---------|------|----------|-------------|------------| | Code scan (PII, routes, secrets) | - | Yes | Yes | Yes | | Seed test (proof capsule) | - | Yes | Yes | Yes | | Continuous scanning | - | Yes | Yes | Yes | | Dashboard (scan history) | - | Yes | Yes | Yes | | Database scan (DB Probe) | - | - | Yes | Yes | | CI/CD integration | - | - | Yes | Yes | | Proof certificate | - | - | Yes | Yes | | On-prem deployment | - | - | - | Yes | | White-label | - | - | - | Yes |

Options

--license-key KEY    License key (or set NDC_LICENSE env var)
--db URL             Database connection string (or set DATABASE_URL)
--dir PATH           Project directory to scan (default: cwd)
--output PATH        Output directory for reports (default: cwd)
--ci                 CI mode — minimal output, exit codes
--fail-on LEVEL      Exit 1 on issues at this level: critical, high, medium
--skip-send          Don't send metadata report to NoData
--version            Show version
--help               Show help

What Gets Scanned

Code Scanner (7 checks):

• PII field detection (24 categories: email, phone, SSN, credit card, etc.)
• Encryption coverage (are PII fields encrypted?)
• Route auth detection (42+ auth patterns)
• Stack detection (framework, database, hosting)
• Secret scanning (26 patterns, Gitleaks-style)
• Dependency vulnerability checks
• CVE detection (20 known vulnerabilities)

Database Scanner (6 checks):

• Schema introspection (table/column inventory)
• PII column detection
• Encryption verification (LEFT(value,13) only — never reads full values)
• RLS policy coverage
• Access control audit
• Infrastructure checks (SSL, timeouts)

Privacy Guarantee

• Guard runs entirely on your machine
• Source code is never uploaded
• Database values are never read (only schema metadata)
• The metadata report contains only: table names, column counts, boolean flags, scores
• You can verify this by diffing nodata-full-report.json vs nodata-metadata-only.json

Dashboard

After running Guard, log in at nodatacapsule.com/guard with your license key to see:

• Score trends over time
• Scan history with comparison
• Issue breakdown by severity
• Encryption coverage progress
• Database security posture

CI/CD Integration

GitHub Actions

- name: NoData Guard Security Scan
  run: npx nodata-guard --license-key ${{ secrets.NDC_LICENSE }} --ci --fail-on critical
  env:
    DATABASE_URL: ${{ secrets.DATABASE_URL }}

GitLab CI

security-scan:
  script:
    - npx nodata-guard --license-key $NDC_LICENSE --ci --fail-on critical
  variables:
    DATABASE_URL: $DATABASE_URL

License

Proprietary — see LICENSE.md

Links

• Website
• Guard Dashboard
• Getting Started
• Pricing