Your submitted reports are unlisted
Each submitted scan receives a random report link. We do not place submissions in the public feed. Anyone who has the link can read the report, so treat it as a sharing credential. Unlisted does not mean authenticated or confidential.
Public discovery observations
MagicSword separately discovers and scans public GitHub skills every 15 minutes, working through a saved inventory and checking known repositories for changed revisions. Sanitized observations from this discovery process can appear in the homepage carousel and public observation pages. The carousel covers scans observed in the last 24 hours; it does not include your submitted reports. A scheduled pass is not a promise that every repository is checked at that interval. Search indexing and bounded batches limit coverage. Uploads never enter this inventory.
What a report contains
Stored scan data includes the repository and resolved commit, or the uploaded filename, size, and SHA-256 hash, plus skill paths, timing, coverage, rule identifiers, file locations, and sanitized findings. When requested, it also includes the bounded AI assessment. Source archives are temporary scanner working data and are removed after processing. Reports do not intentionally include raw source excerpts, matched credential values, or raw provider responses.
Uploaded files
Uploads are held in private temporary storage until processing finishes, then deleted. A cleanup job removes abandoned files after 24 hours; deletion can be delayed during a service outage. The file itself is not downloadable through your report link. Sanitized reports remain stored separately. A SKILL.md-only scan covers that file; include the bundled files in a ZIP for broader coverage.
Optional AI analysis
If you select AI intent assessment, bounded source windows around matches are redacted and sent through OpenRouter to the configured model provider. Redaction reduces exposure but cannot guarantee that every sensitive value is removed. Only enable AI for source you are comfortable sending to these providers. Scheduled public discovery may also include advisory AI analysis, which is labeled in the observation.
Abuse protection
Hosted deployments use bot protection and submission limits. Rate limiting uses a keyed hash of the client address. The application does not need to store the raw address for that purpose. Hosting and bot-protection providers may separately process network metadata under their own policies.
Website analytics
Public pages may use Google Analytics to understand site traffic. Google can process cookie identifiers, browser information, and network metadata. Our pageview events use fixed page names without search queries or URL fragments. We do not load the analytics tag on unlisted report pages or send scan inputs, uploaded files, or report contents in analytics events. Advertising personalization and Google signals are disabled in our tag configuration.
Retention and contact
Reports currently remain stored until removed by the operator. There is no automatic report expiration or end-user deletion flow. Public observation pages remain accessible after leaving the 24-hour carousel. For questions or removal requests, contact MagicSword. Do not post unlisted report links in public issues or messages.