Privacy

Seatbelt works like your coding agent. To check your code, it reads your code. Your agent already streams your whole project to an API on every edit. Seatbelt sends it once, to the hosted engine, to catch mistakes before you share the link.

Your source passes through the detector and is not stored. It is read, then discarded, and only the redacted report is kept. Here is exactly what does and does not leave, a tighter pipe than the one you already trust.

What gets uploaded

A zip of your project source, built on your machine by the MCP. It is an allowlist, not a filter: only source and config file types go in, the code and config the check actually reads. Images, binaries, media, and fonts never leave your machine, because nothing outside the allowlist is ever added.

What never leaves

  • Dependencies and history. node_modules, .git, and the common build dirs (.next, dist, build, and the rest) never leave, and neither do most dotfiles.
  • Credential files, named. Some dotfiles do go up, because they are where a committed token actually sits. Alongside .env files, the zip includes .npmrc, .envrc, .netrc, .pypirc, .dockercfg, .git-credentials, and .htpasswd. These are worth calling out: an .npmrc holds a publish token for your packages, and a .netrc or .git-credentials can hold logins for services that have nothing to do with the app you are scanning. If one is sitting in your project, we would rather read it and tell you than skip it and call the scan clean. If you want any of them to stay put, list it under ignores.
  • Database contents. .sqlite and .db files are sent as empty placeholders. A database sitting in a public folder still trips the gate, but zero database bytes leave your machine.
  • Your build. The build command is never uploaded. Hosted scans skip the build gate.
  • Local secrets. Files like .env.local and .env.production.local stay on your machine. A committed .env with real values is still flagged, because that one ships.
  • Large files. Anything over 512KB is skipped.

You choose what leaves

Anything you list under ignores in .seatbelt/config.json is never scanned or uploaded. Add a folder or file name there and it stays on your machine.

How it is handled

  • Size cap. The zip is capped at 4.5MiB, checked on your machine before any bytes are sent. Over the cap you get a plain stop, never a partial upload.
  • On the server. The zip is written to a private temp directory, unpacked there, and read. The directory is removed when the scan returns, on the error path as well as the normal one. Nothing of your source is kept afterwards, and nothing is copied anywhere durable along the way. The report that is kept holds file paths, line numbers and redacted cues, never a whole secret value.
  • Who can read the report. A report lives at a long random address, and anyone who has that address can open it. There is no password on it, no expiry, and no delete button today, so treat the link the way you would treat a password. That openness is the point at handoff: the person you send it to can verify it without an account. If it is more exposure than you want, run the engine locally and nothing is uploaded at all.
  • Told at scan time. The privacy line prints on every hosted scan, in your agent, before the results. It names what leaves, the credential files above, and the fact that the report link is the whole access control. Nothing on this page is something you only find out here.

Or upload nothing

Point the MCP at a local API and it scans on your machine directly, uploading nothing. Teams that cannot let source leave their environment run the engine locally.

The marketing site

This page, and the rest of the public site at withseatbelt.com, uses one analytics tool: Google Analytics, for aggregate traffic counts. It runs only on these marketing pages.

Snitcher, a tool that identified which companies visited, was removed on 14 August 2026. Its script no longer loads and we no longer receive company level visitor data. This paragraph stays rather than vanishing, because a privacy page that quietly drops a vendor is indistinguishable from one that never disclosed it.

It is walled off from the product. The scanner, the detector, and the app never load it. Nothing you scan, no source, no config, no report, is ever sent to Google Analytics or used for this. Everything above about what leaves your machine still holds, because this touches none of it.

We honor Global Privacy Control and do not run it for visitors in the EU, EEA, UK, or Switzerland. To opt out anywhere else, turn on Global Privacy Control in your browser, or email hello@withseatbelt.com and we will exclude you.

withseatbelt-privacy

# product
name      Seatbelt
tagline   Security at the speed of your agent
what      A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method    Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings  /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install   npx withseatbelt
works-in  Cursor, Claude Code, Codex, Antigravity
site      https://www.withseatbelt.com
contact   hello@withseatbelt.com

# current-page
path         /privacy
title        Privacy: what leaves your machine
description  Seatbelt reads your code the way your coding agent does. What gets uploaded to the hosted engine, what never leaves, and how it is handled.

# document
what    The Seatbelt privacy page: what leaves your machine when Seatbelt checks your code, and how it is handled.
note    The authoritative text is the human view of this page. This summary is not the policy.
covers  What gets uploaded
covers  What never leaves
covers  How it is handled
covers  Or upload nothing
covers  The marketing site

# pages
/                   Seatbelt home
/get-started        install: npx, the /seatbelt skill, or MCP
/pricing            every price, in USD, before tax
/app                scan a URL in the browser
/how-it-works       the method: what the scan reads, and how a check earns its place
/before-you-launch  pre launch checklist
/risks              common risks in AI-built apps
/commands           command reference
/labs               measured security research, and notes on how we build
/aiuc-1             Seatbelt as the output-scanning layer for AIUC-1
/supervision        commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index)
/security           how we handle your code and data
/privacy            privacy policy
/terms              terms, incl. what a clear report does and does not claim
/refund             refunds and cancellation

# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
  deterministic, so a published number can be re-run without asking us.