Privacy in aven-stellar: What the CLI Collects

A complete breakdown of what the aven-stellar CLI collects, what it never touches, and how .avenignore gives you full control over your report.

Aven is built on a privacy-first principle — work can be verified without exposing intellectual property. The CLI collects only the metadata needed to demonstrate that real work happened: timing, Git statistics, and file paths. It never reads file contents, records keystrokes, or transmits anything excluded by your ignore files.

What the CLI Collects

The session report contains the following information:

Collected	Details
Session timing	Start time, end time, total seconds, active seconds, and idle seconds
Git branch	Branch name at session start and at session end
Commit metadata	Commit hash, message, timestamp, and additions/deletions count per commit
Changed file paths	Relative paths only (for example, src/auth.ts or tests/auth.test.ts)
Diff statistics	Number of lines added and deleted per file — no file contents
Worker statement	The optional summary you write at stop time

The CLI process never reads file contents. Change statistics are derived from git diff --stat-style output — only line counts and paths, not the actual code.

What the CLI Never Collects

The following data is explicitly out of scope and is never included in any report or network request:

• File contents — no source code is uploaded at any point
• Keystrokes, mouse activity, or screen recordings
• Screenshots or camera input
• Your Stellar secret key or Freighter wallet credentials
• Files and directories excluded by .gitignore or .avenignore
• Project code execution — the CLI never runs your code or test suite
• Dependency installation — the CLI never runs package manager commands in your repository
• Environment variables or project configuration values
• Secrets, API keys, or tokens found in your working directory

The .avenignore File

On the first start, the CLI automatically creates .avenignore at your repository root with a set of safe defaults. This file works exactly like .gitignore — add glob patterns to exclude additional paths from the session report. Both files are combined: any path matched by either .gitignore or .avenignore is excluded.

The default .avenignore written by the CLI:

.env
.env.*
*.pem
*.key
*.p12
node_modules/
.next/
dist/
build/
coverage/
.git/

You can add your own entries below the defaults:

# .avenignore
*.env
*.pem
secrets/
.env.local
credentials.json
private/

In addition to pattern matching, the CLI scans every path for secret signals — patterns that look like private keys, bearer tokens, or password assignments. Any path that matches is automatically excluded even if it is not listed in .avenignore.

Authorization Model

The CLI connects to the Aven dashboard using a time-limited authorization token rather than your wallet credentials directly.

1. On first use, aven start opens the Aven dashboard in your browser
2. You authorize the connection using your Freighter wallet — the CLI receives a short-lived token, never your secret key
3. The token is stored in .aven/config.json, scoped to your repository
4. On subsequent sessions the CLI reuses the saved token; if it has expired, aven start reopens the browser for a fresh authorization
5. The CLI verifies that your wallet address matches the stream recipient before every session

Your Stellar secret key never leaves Freighter and is never transmitted to the CLI, the dashboard, or any Aven API.

File Categories

The CLI categorizes every changed file to determine whether it counts toward the verification scope. Files marked generated or dependency are excluded from verification automatically.

Category	Examples
source	.ts, .tsx, .js, .jsx, .py, .rs, .go, .sol
test	*.test.ts, *.spec.js, files inside __tests__/
documentation	*.md, *.mdx, *.txt, *.rst
configuration	package.json, Cargo.toml, *.yaml, *.toml, dotfiles
asset	.png, .jpg, .svg, .webp, .psd
generated	Files inside dist/, build/, coverage/, or generated/
dependency	package-lock.json, pnpm-lock.yaml, yarn.lock, Cargo.lock

Only source, test, documentation, and configuration files are submitted for on-chain verification. Generated and dependency files are recorded in the local report for completeness but stripped from the submission.