Trustabl collects anonymous usage data to help improve the product — to understand which SDKs users scan most often, catch reliability issues, and measure adoption. This page is the complete and authoritative list of every event and every property that can be sent. It is updated in the same commit as any event schema change.

Telemetry is off by default. On your first interactive scan, Trustabl asks you to choose a level. You can change your choice at any time — see Manage telemetry below.

No matter which events fire, Trustabl never sends:

In CI (CI=true or a recognized CI provider env var), telemetry defaults to Disabled unless TRUSTABL_TELEMETRY is explicitly set.

Every event carries an anonymous_id that identifies the installation, not the person:

The anonymous ID is never derived from machine fingerprinting: no hostname, no MAC address, no username hash. It is a random UUID that identifies this Trustabl installation for product analytics only.

The repo_id_hash property on scan.completed is separate from the anonymous ID: it is a one-way hash of a CI repo env var (see below) used only to count unique repos, not to identify users.

These properties are merged into every event automatically:

Fired when a scan begins, after argument validation passes (so an invalid --detectors flag does not emit this event).

Fired on a successful scan (exit code 0 or 1 — findings present or not, but no scanner error).

Fired when the scan exits with code 2 (a scanner or I/O error, not a findings-based exit).

Fired for every non-scan subcommand invocation.

Fired only when a user explicitly chooses "Send anonymous crash report" after a panic. It is never sent automatically. Crash reporting is independent of the telemetry setting — this event fires the same way whether telemetry is full, minimal, or disabled, because the per-crash prompt is its own separate consent. The only thing that stops it is the absence of a PostHog key in the build (nowhere to send). Turning telemetry off does not turn off the ability to send a crash report; the choice is made fresh at each crash and is never stored.

Three mechanisms for explicit control, evaluated in this order (the first-run prompt handles the initial choice):

1. Environment variable (highest priority)

export TRUSTABL_TELEMETRY=disabled   # or: 0
export TRUSTABL_TELEMETRY=minimal
export TRUSTABL_TELEMETRY=full       # or: 1

2. CLI commands (persisted to config file)

trustabl telemetry off      # disable — no data sent
trustabl telemetry minimal  # version and outcome only
trustabl telemetry full     # all anonymous usage stats
trustabl telemetry status   # show current level and its source

3. Config file (manual)

Edit ~/.config/trustabl/telemetry.json:

{"mode": "minimal", "anonymous_id": "your-uuid-here"}

Valid values for mode: "disabled", "minimal", "full".

The config file is created with directory permissions 0700 and file permissions 0600. It is never created in CI (where CI=true or a recognized CI provider env var is set).

When Trustabl experiences an unrecovered panic, it always writes a scrubbed crash report to ~/.config/trustabl/crash-<UTC-timestamp>.log (mode 0600, directory 0700). This happens even in CI or non-interactive environments — the local file is the permanent, transparent record of what was captured.

The crash report contains the scrubbed panic value and stack frames (see crash.reported properties above for exactly what is included). Nothing is transmitted without an explicit choice: after writing the file, Trustabl prompts the user with a numbered menu:

Help us fix it? No source code or file contents are sent.
  1. Send anonymous crash report
  2. Open GitHub issue
  3. Do nothing

Enter 1, 2, or 3 [default: 3]:

This prompt is shown only in an interactive terminal (stderr is a TTY and neither CI nor a recognized CI provider env var is set). In CI or when output is piped, no prompt appears and nothing is sent. The default action is always "Do nothing". All three options are shown on every crash — the "Send anonymous crash report" option is never hidden or renumbered based on the telemetry setting, because crash reporting is a separate consent from usage telemetry. Choosing "Send anonymous crash report" fires the crash.reported event and works even when telemetry is disabled (it only no-ops if the build has no PostHog key); choosing "Open GitHub issue" opens a pre-filled URL in the browser — no data is transmitted by Trustabl itself.

Trustabl uses PostHog as its telemetry backend. Events are sent over HTTPS. PostHog is a product analytics platform; Trustabl does not use it for advertising, profiling, or any purpose other than product improvement. PostHog's privacy policy is at posthog.com/privacy.

Events are batched and sent asynchronously — no telemetry call ever adds latency to a scan. Network errors and slow endpoints are silently discarded; they never appear on stderr and never affect the exit code.

On the first scan in an interactive terminal (TTY), before any scan output, Trustabl asks:

Trustabl collects anonymous data to help improve the product.
No source code, file paths, repo names, or finding details are ever sent.
Learn more: https://trustabl.ai/telemetry

Choose a telemetry level:
  1. Minimal  - Version and outcome
  2. Full     - Usage stats
  3. Disabled - No data

Enter 1, 2, or 3 [default: 3]: 

The choice is saved to ~/.config/trustabl/telemetry.json and never asked again. Empty input or no response defaults to Disabled. The prompt is never shown in CI or when output is piped.

Open an issue at github.com/trustabl/trustabl/issues or reach out on Discord.