Your submitted reports are unlisted
Each submitted scan receives a random report link. We do not place submissions in the public feed. Anyone who has the link can read the report, so treat it as a sharing credential. Unlisted does not mean authenticated or confidential.
Public discovery observations
MagicSword separately samples and scans public GitHub skills. Sanitized observations from this discovery process can appear in the homepage carousel and public observation pages. The carousel covers scans observed in the last 24 hours; it does not include your submitted reports. Discovery is sampled and does not cover every repository.
What a report contains
Stored scan data includes the repository, resolved commit, skill paths, timing, coverage, rule identifiers, file locations, and sanitized findings. When requested, it also includes the bounded AI assessment. Source archives are temporary scanner working data and are removed after processing. Reports do not intentionally include raw source excerpts, matched credential values, or raw provider responses.
Optional AI analysis
If you select AI intent assessment, bounded source windows around matches are redacted and sent through OpenRouter to the configured model provider. Redaction reduces exposure but cannot guarantee that every sensitive value is removed. Only submit public source you are comfortable having analyzed this way. Scheduled public discovery may also include advisory AI analysis, which is labeled in the observation.
Abuse protection
Hosted deployments use bot protection and submission limits. Rate limiting uses a keyed hash of the client address. The application does not need to store the raw address for that purpose. Hosting and bot-protection providers may separately process network metadata under their own policies.
Retention and contact
Reports currently remain stored until removed by the operator. There is no automatic report expiration or end-user deletion flow. Public observation pages remain accessible after leaving the 24-hour carousel. For questions or removal requests, contact MagicSword. Do not post unlisted report links in public issues or messages.