Offline means no CLI egress
Running with --offline disables network enrichment and telemetry. The Preview build guide pairs it with --no-telemetry for an explicit, reviewable no-egress workflow.
security & data handling
Your repository stays in the environment you control.
CipherMap is designed for local analysis. This page separates the default local data flow, optional connected paths, and the exact maturity limits of the invitation-only Free developer source preview.
Local data flow
From source to evidence without a hosted upload
- 01
Repository in your environment
CipherMap reads the path you select. The Free developer-preview workflow does not require uploading a repository or creating a hosted project.
- 02
Analysis on your machine
The CLI applies its embedded detection rules locally. Use --offline to disable optional network paths and --no-telemetry to suppress telemetry explicitly.
- 03
Evidence stays local
Terminal, JSON, and SARIF results are written locally at your direction. Paid evidence formats remain behind the separate Tier A commercial-build boundary.
Network boundary
Local by design, explicit when connected
“Local-first” does not mean every possible command is permanently disconnected. It means the core scan happens locally and connected behavior is a separate, operator-chosen path.
Connected actions are explicit
Outside offline mode, supported enrichment or integration commands may contact the service you configure. Those paths are separate from local scanning and inherit the destination provider's handling rules.
No paid control plane in the Free build
Normal source-preview builds intentionally disable Tier A and Tier B licences. No account, hosted dashboard, or provider integration is needed for the Free local workflow.
Release maturity
Evidence before claims
CipherMap publishes the boundary of what has been exercised instead of treating a successful compile as production qualification.
Read the Preview build boundary- Preview distribution
- Approved recipients build a reviewed, history-free source archive locally. No native installer or automatic updater is distributed in this Preview.
- Platform evidence
- Darwin/arm64 has bounded runtime-smoke evidence. Linux and Windows are compile-only until native runtime and lifecycle qualification pass.
- Commercial workflows
- Tier A is implemented behind a commercial-build gate. Tier B provider and fleet workflows remain controlled beta, with live-provider qualification pending.
- Source changes
- Remediation proposals are read-only previews. Production source publication, TUI writes, and LSP writes are unavailable in this release.
What CipherMap does not claim
- CipherMap is not a certification, compliance determination, or substitute for professional review.
- Static analysis can miss cryptography and can produce findings that require human validation.
- The Free Preview is not a signed native release, a production Windows qualification, or an Enterprise GA release.
- Tier B integration descriptions do not imply live qualification against every external provider.
To report a suspected CipherMap security issue privately, email security@ciphermap.io with a minimal reproduction and avoid including third-party source code or secrets.