Your work runs on your machines. Every cloud connection is documented.
DevIntern is a local worker, not a cloud that executes your code. Your source and vendor credentials stay on your machines. License validation, the optional event relay, anonymous analytics, and error reporting are narrow connections described below.
The full inventory
Every credential, where it lives, where it goes
Vendor credentials stay in git-ignored local configuration. devintern init
creates the configuration and protects it from accidental commits. Account and relay
pairing artifacts are stored separately and are also git-ignored.
Jira credentials
JIRA_EMAIL, JIRA_API_TOKEN
Atlassian's API only
Fetch tasks, move statuses, post summaries
Linear API key
LINEAR_API_KEY
Linear's API only
Fetch and update issues
Trello credentials
TRELLO_API_KEY, TRELLO_API_TOKEN
Trello's API only
Fetch and update cards
Asana / Azure DevOps tokens
provider-specific
Their own APIs only
Fetch and update tasks
GitHub / Bitbucket tokens
GITHUB_TOKEN, BITBUCKET_TOKEN
Your repo host only
Open pull requests, read review comments
AI provider keys
e.g. ANTHROPIC_API_KEY
Your AI provider only
Your coding agent runs on your own contract
Git push credentials
your existing SSH key or credential helper
Your repo host only
Push branches, exactly as you do by hand
DevIntern license key
LICENSE_KEY
DevIntern's license API
Validate an unattended automation entitlement
DevIntern session and relay token
.auth-session.json, relay.json
DevIntern auth and relay only
Use the Worker Pilot, pair the optional relay, and receive reference-only events
Tracker, repository-host, and model-provider credentials are sent only to their respective vendors. DevIntern services never receive those credentials.
DevIntern services
What can leave your machine
License checks
Paid unattended runs send the license key and entitlement context needed to validate access. Worker Pilot checks send the signed-in account identity and trial state. Raw tracker keys, paths, task content, and code are not sent. Interactive runs require neither login nor a license.
Optional event relay
The relay sees reference envelopes such as source, event type, repository name, and issue or pull-request number. It never receives code, diffs, ticket bodies, comment text, or vendor credentials. Plain polling works without it.
Diagnostics you can disable
Anonymous analytics sends product mode and technical metadata, never task or repository identity. Error reporting can include exception messages and stack traces. Disable them with DEVINTERN_TELEMETRY_DISABLED=1 and SENTRY_DISABLED=1.
By design
What DevIntern's servers never hold
The worker and relay architecture does not send your work payloads to DevIntern. Error reporting is separate and optional because exception messages and stack traces can contain local diagnostic context.
- Your source code, diffs, or repository contents
- Your tracker credentials (Jira, Linear, Trello, Asana, Azure DevOps)
- Your GitHub or Bitbucket tokens
- Your AI provider keys
- Ticket bodies, review comments, or pull request contents
Filesystem hygiene is built in: credentials are confined to the project-local env file, which is git-ignored on creation.
FAQ
Security questions, answered plainly
What data does DevIntern send to its own servers?
Depending on what you enable: license entitlement checks, reference-only relay envelopes, anonymous product analytics, and crash reports. The relay and analytics exclude task content, code, diffs, comments, repository paths, and vendor credentials. Analytics, error reporting, and the relay can all be disabled.
Where do my credentials physically live?
Vendor credentials live in a git-ignored .env file on your machine or server. Account and relay pairing artifacts live in git-ignored DevIntern config files. devintern init creates the local configuration and protects it from accidental commits.
Which model sees my code?
Only the one you configure. DevIntern drives the coding agent you choose, with your own keys, so your code goes to your AI provider under your existing contract and nowhere else.
Does anything run in DevIntern's cloud?
No code execution runs in DevIntern's cloud. The worker runs on your laptop, devbox, or VM. The optional relay receives reference-only events and your local worker fetches the real ticket or pull-request data directly from its source.
Bring it to your security review
Questions this page does not answer? Ask, and we will answer them in writing.