Question 1

Do you train AI models on customer code?

Accepted Answer

No. Our AI models (DeepSeek V3 and Gemini 2.5 Flash) process your code for analysis only. They do not retain, cache, or learn from your code.

Question 2

What data do you store?

Accepted Answer

Only encrypted findings — the issues, warnings, and recommendations generated by the analysis, encrypted with AES-256-GCM at rest. We do not store source code, file contents, or authentication secrets.

Question 3

Is there an offline mode?

Accepted Answer

Yes. The CLI (kedgr scan --offline) runs local heuristic analysis without any network connection. No code leaves your machine.

Question 4

Does the CLI redact secrets before uploading?

Accepted Answer

Yes. The CLI automatically detects and redacts API keys, tokens, passwords, and other secrets before uploading to the cloud.

Question 5

What exactly does Kedgr scan for?

Accepted Answer

Kedgr scans for hardcoded secrets, dependency vulnerabilities (via OSV.dev), code structure anti-patterns, ESLint violations, cross-file inconsistencies, and language-specific issues across JavaScript, TypeScript, Python, Go, Java, Ruby, PHP, C#, and Rust.

Question 6

What AI models do you use?

Accepted Answer

Primary: DeepSeek V3 via OpenRouter. Fallback: Gemini 2.5 Flash. Orchestration via Google Genkit framework with 7 analysis flows. Limits: 15 requests/minute, 8,000 tokens per request, 3 retries with exponential backoff.

Question 7

What languages are supported?

Accepted Answer

Deterministic engines support JavaScript, TypeScript, Python, Go, Java, Ruby, PHP, C#, Rust, and any language with regex-detectable patterns. Dependency scanning covers 8 package ecosystems. AI analysis is language-agnostic.

Question 8

How long does a scan take?

Accepted Answer

Most scans complete in 10-60 seconds depending on codebase size. Limits: max 1,000 files per scan, files larger than 10MB are skipped, 5-minute total timeout.

Question 9

Can I suppress false positives?

Accepted Answer

Yes. Use inline directives: kedgr:ignore, skipcq, or nosemgrep in comments on the relevant line. You can also configure rulesets in the dashboard to disable specific rules per project.

Technical FAQ

Ephemeral Processing & Privacy

Analysis & Engines

Integrations

Security & Compliance

Pricing & Billing