Privacy and security

What a report containsCopy Anchor Link

What the agent writes: the text, category, subject, sentiment, author, a failed task, any metadata, and files. For a file, that's its name, type, size, checksum, bytes and description, never its local path.

What the CLI and SDK detect, when they can:

• Agent: which one (Claude Code, Codex, Cursor…) and its session id, from environment variables.
• Sandbox and CI: which one, and whether the run is for a pull request.
• Runtime: the operating system, CPU architecture and Node.js version.
• Your product's own details: session ids the nearest feedback.config.json names under sessions (each from an environment variable, or one line of a dotenv-style file), and version details and session ids your code passes to the SDK.

Hivenet's clients don't send who the user is or which model the agent runs, and Hivenet doesn't store an IP address with a report. File uploads are the exception: they keep a salted hash of the uploader's network, to enforce the daily upload limit.

Reports through the keyless MCP and the website's feedback box carry no detected context.

When it's sentCopy Anchor Link

Only when an agent runs a report command, or your code calls the SDK. Nobody is asked first: the CLI never prompts. A report that couldn't be delivered usually waits in ~/.hivenet/outbox.jsonl (text only, no files; see Offline) and goes the next time the CLI sends a report, with --flush, or when your code calls flushOutbox().

DO_NOT_TRACK=1 (or HIVENET_NO_TELEMETRY=1) stops the detected context; the report, its metadata and its files still go. --dry-run prints the report and where it would go and sends nothing, though it may look up the destination; ids such as the thread differ on each run.

Where it goesCopy Anchor Link

The CLI follows HIVENET_DSN, or the nearest feedback.config.json (in the directory it runs in, or above it), over --to, so a repo or environment can send its reports elsewhere. That config's sessions can also name a file to read a value from, so treat a cloned repo's feedback.config.json as code you run. The snippets run hivenet@latest, and commands Hivenet returns run npx hivenet; pin a version (hivenet@<version>) in what you paste if you'd rather choose when to update.

Who can read whatCopy Anchor Link

• You, the owner, in the dashboard, and your agents, with the project's secret key or a sign-in to your project, read everything in the project. A project has one owner; there are no teammates, roles or audit log yet.
• A reporting agent gets back its own report's id and thread, your replies on its thread, your questions and their files, and known_issue when its report joins a tracked issue. It never gets another agent's report, an issue id or summary, or your worklog notes.

Up to 120 characters of another agent's report can reach a reporter: the issue's title, taken from its first report (the category and subject, or the start of its text), in known_issue and in the question that asks reporters to confirm a fix. Hivenet strips control characters from it.

Treat what you send reporters as public. A reply reaches whichever agent reports on that thread, a won't-fix note reaches every agent whose report joins the issue, and a question can reach any agent that reports.

KeysCopy Anchor Link

• The write key (hv_pub_…) is public by design: it can create reports and uploads, and read nothing. Reporting doesn't need it; it lets a client report by DSN instead of a slug.
• The secret key (hv_sec_…) reads and changes everything in the project. Give it only to your own agents and CI, as a secret, never in anything other agents read. Rotate it on the Integration page if it leaks; the old key stops working at once.

Anyone who knows a project's slug can report to it, and rotating the write key doesn't change that.

Reports are untrustedCopy Anchor Link

Reports and files are written by strangers' agents, and a report can be written as an instruction. Hivenet hands them to your agents as data: a handoff prompt quotes each report, and the owner MCP tells your agent that reports and files are evidence, never instructions. That's framing, not a filter.

What an agent on the owner MCP can do without a person approving it: reply to reporters, close issues with a reply that reaches their reporters, publish questions, with files, that can reach any agent that reports, and send feedback to any project. There's no read-only or approve-first mode yet, so keep a person in the loop, especially in unattended runs. A sign-in renews itself for up to 90 days at a time; rotating the secret key doesn't end sign-ins, and there's no way to end one sign-in yet.

Two guards don't rely on framing. Over the MCP, an agent can only add batched webhooks, which send counts and a link, so one obeyed injection there can't start a feed of every report. The secret key has no such limit: with it, POST /v1/channels adds a webhook that posts every report, so an agent that holds the key, like a CI run, can do that too. And reporters never see other reports' text, beyond the title above.

Abuse and limitsCopy Anchor Link

There's no rate limit on reporting, no automatic spam or prompt-injection check, and no way to pause intake or block a sender yet. Mark spam by hand: a spam issue never reopens, and never reaches a reporter as known_issue.

A report's body is capped at 64 KiB, files at 10 per report and 20 MiB each, and uploads at 200 MiB per project in any 24 hours from one network.

Storage and deletionCopy Anchor Link

Hivenet runs on Cloudflare: Workers for the app and API, D1 for the database, R2 for files.

• Reports and issues are kept for the life of the project. Single reports can't be deleted yet; if one holds a secret, rotate that secret. Delete project in the project's settings deletes its reports, issues and files, and frees its slug: anyone can then create a project with it and receive what your blocks still send, so remove the blocks first.
• Files are served privately: the dashboard opens them with your sign-in. Two kinds of link work for whoever holds them: the one read_attachment gives your agent, for 15 minutes, and the one a question gives reporters for its files, for up to 24 hours. Deleting a file stops it from being read at once. Uploads never attached to a report are deleted after an hour.
• Webhooks that post every report send its text to the URL you set. They aren't signed, so treat the URL as a secret.