Skip to content
enodia

Privacy

enodia is a command-line tool you run on your own machine. It has no telemetry, no usage statistics, no update check and no account. EpicMorg runs no server that enodia talks to and receives nothing from it.

This page mirrors enodia’s own PRIVACY.md.

What enodia connects to

Section titled “What enodia connects to”
  • Your own services — the targets listed in your enodia.yaml, over HTTPS, SSH or their native protocols, with the credentials you configure, to read their version (and, for Linux hosts, the installed package list).
  • endoflife.date (https://endoflife.date/api/...) — to fetch public release and end-of-life dates. The request names a product (for example postgresql); no host names, addresses, versions or other data about your fleet are sent.
  • GitHub API (https://api.github.com/repos/.../releases, .../tags) — for products whose releases are published on GitHub. Same as above: only the public repository name is in the request. If you set GITHUB_TOKEN, it is sent to GitHub only, to raise the rate limit.
  • CVE database publishers, only when you run enodia cve update, and only those your cve.*.path entries name: nvd.nist.gov, bdu.fstec.ru, security-tracker.debian.org, the OVAL publishers (Canonical, Red Hat, AlmaLinux, Oracle, Astra Linux, RED OS), secdb.alpinelinux.org, mariadb.com, api.atlassian.com, www.postgresql.org and nginx.org. The requests are plain downloads of public files; the only thing they say about your fleet is which OS releases and PostgreSQL majors you fetch data for.

That is all. Every other command only reads the CVE files from disk — see CVE correlation.

The HTML report loads Bootstrap from a CDN (jsDelivr / cdnjs) in the browser that opens it when html.assets: cdn is set; the default (inline) makes no external requests at all — see Reporting.

What enodia stores

Section titled “What enodia stores”

Only on your machine, and only where you tell it to:

  • the inventory, reports and history files you write with -o;
  • a cache of endoflife.date/GitHub answers and parsed CVE databases in the OS cache directory (~/.cache/enodia, %LocalAppData%\enodia) — safe to delete at any time.

Nothing is sent anywhere else, and nothing is retained by EpicMorg.

This website

Section titled “This website”

The enodia.sh, get.enodia.sh and docs.enodia.sh websites — not the enodia tool — use Yandex.Metrica web analytics to count visits.

Contact

Section titled “Contact”

Questions: open an issue at github.com/EpicMorg/enodia/issues.