Migration scanning stays local unless you explicitly enable a network feature.
BoundaryCI separates deterministic scanning, managed or bring-your-own-key Fireworks review, and Cloud history so teams can control which data is allowed to leave their environment.
Deterministic scans are local-first
The CLI reads migration files on the developer machine or CI runner. It does not require database credentials and deterministic scans make no BoundaryCI network request.
Cloud upload is explicit and minimized
With --upload, the CLI sends repository and commit context, summary counts, finding metadata, and short redacted evidence and remediation snippets after producing the local report.
- Complete migration files are not uploaded
- Absolute scan targets and migration-file inventories are removed
- Common secret patterns are redacted before transport
- Repository-bound ingestion tokens are stored only as SHA-256 hashes
- Tenant-owned Cloud tables use row-level security
Managed Fireworks review requires authorization
Paid Cloud organizations remain deterministic-only until an owner or administrator accepts the managed-review disclosure. The runner checks plan, subscription, organization consent, and repository settings before it transmits migration text. No migration content is included in that eligibility check.
After authorization, the runner redacts common secret patterns and sends at most 80,000 characters through BoundaryCI to Fireworks. BoundaryCI does not store the migration input; normalized AI findings can be stored with Cloud history. Each repository and workflow has an opt-out.
Direct --fireworks mode remains available for customers who prefer their own Fireworks key and account. In either mode, deterministic scanning continues when the optional review is unavailable unless direct mode was explicitly marked required.
Security claims remain bounded
BoundaryCI detects a focused set of tenant-isolation regressions. It does not replace threat modeling, code review, runtime authorization tests, penetration testing, or an independent security assessment.
Report vulnerabilities privately
Security reports should follow the repository security policy rather than a public issue. Include the affected version, reproduction conditions, impact, and a safe contact method.