Born from a public exchange on X: a developer checked his own signed NDAs and found no "publicly known" exception at all, not even for programming languages. Under a literal reading of contracts that strict, even the bundle's bounded aggregates (languages, categories, time spans) could be argued to be covered.
Our position today is honest but blunt: the CLI guarantees the data boundary (no code, no file names, no employer name, nothing beyond the reviewed bundle), and what a specific contract allows is the user's call. For ultra-strict contracts, that answer today amounts to "don't use it". This issue asks whether there's something better.
The idea: a minimal-disclosure mode
An opt-in scan/submit profile that shares strictly less than the standard bundle, for users whose contracts sit at the paranoid end. Candidate reductions, each with a real cost to weigh:
- Drop
repo.host_type (currently the host kind only, but even "github" is information).
- Drop per-language extensions, keep only coarse category shares (or drop categories too and keep only capability slugs).
- Coarsen time: no first/last dates, only total span bucketed ("1-2 years").
- Drop hour/weekday histograms entirely.
- Keep: capability slugs (the closed vocabulary is the core), ownership ratio, and the attestation.
The open questions
- Is a credential that thin still worth anything to the person holding it, or does minimal-disclosure mode produce evidence too weak to bother with? (Maybe that tradeoff, stated clearly at scan time, IS the feature.)
- Does the defense still work with less context to generate questions from?
- Schema-wise this is a reduction, not new data, but it still needs the full ceremony if field presence rules change.
- Should the standard mode stay the default, with this behind an explicit flag like --minimal?
Opinions welcome, especially from people whose contracts actually read like this.
Born from a public exchange on X: a developer checked his own signed NDAs and found no "publicly known" exception at all, not even for programming languages. Under a literal reading of contracts that strict, even the bundle's bounded aggregates (languages, categories, time spans) could be argued to be covered.
Our position today is honest but blunt: the CLI guarantees the data boundary (no code, no file names, no employer name, nothing beyond the reviewed bundle), and what a specific contract allows is the user's call. For ultra-strict contracts, that answer today amounts to "don't use it". This issue asks whether there's something better.
The idea: a minimal-disclosure mode
An opt-in scan/submit profile that shares strictly less than the standard bundle, for users whose contracts sit at the paranoid end. Candidate reductions, each with a real cost to weigh:
repo.host_type(currently the host kind only, but even "github" is information).The open questions
Opinions welcome, especially from people whose contracts actually read like this.