MAGDOX Code Security documentation
Data and deployment
What stays local, what is sent, where it is stored, and the deployment options.
Status: Preview
The design principle is simple: code stays where it is, results go where they are needed. This page is the reference for what that means in practice.
Stays in your environment
- All source files, at every snippet setting.
- Detected secret values.
- The full local report with code context.
- Anything excluded by configuration or outside the project directory.
- Environment variables, shell history and credentials on the machine, other than the MAGDOX token the CLI itself holds.
Sent to MAGDOX
- The findings payload (see Findings payload), after you can inspect it with --show-payload.
- Authentication traffic and requests for rule bundles and vulnerability data.
- Nothing at all with --local-only or --offline.
Deployment options
| Option | Dashboard runs | Rules delivered | Suits |
|---|---|---|---|
| Hosted (default) | MAGDOX cloud, region agreed per engagement | Online, signed bundles | Most teams |
| Self-hosted dashboard | Your infrastructure, from MAGDOX container images | Online or offline bundles | Regulated or restricted networks |
| Air-gapped | Your isolated network | Signed offline bundles imported on a schedule | Classified or disconnected environments |
Agreed per engagement
- Hosting region for the dashboard.
- Retention for runs, findings and reports.
- Snippet policy default and whether it is pinned.
- Identity: email sign-in, enforced MFA, OIDC single sign-on.
- Support contacts and incident-notice commitments.
Deletion
magdox runs delete 8f3c-21 # removes the run, its findings and generated reports
magdox projects archive example # stops new runs; retained data follows the retention period