supaschema is local-first. The CLI and library do not phone home, collect telemetry, upload schemas, or call a hosted supaschema service during diff, check, types, scan, verify, or local source parsing.
Local CLI and library
Schema files, generated migrations, generated TypeScript, generated Zod validators, diagnostics, and reports stay in the repository or process that runs supaschema.
When a config points at a PostgreSQL database, the connection is made from the user’s local machine or CI job to that configured database. supaschema does not proxy that connection through a supaschema-hosted service.
GitHub Action
The GitHub Action runs inside the consumer’s GitHub Actions job. It reads the checked-out repository, runs the packaged CLI, and uses the workflow GITHUB_TOKEN only for the configured GitHub check run, job summary, and PR comment behavior.
Support intake
Public bug reports, feature requests, and support questions are GitHub issue surfaces. Do not include secrets, database URLs, customer data, private schema dumps, tokens, contracts, or confidential roadmap material in public issues.
Security vulnerabilities belong in GitHub’s private advisory flow rather than a public issue.
Network boundaries
supaschema has no hosted contract registry or entitlement service. contracts export and contracts diff read and write local schema-contract JSON only.
Commands that explicitly target Git, GitHub, npm, or a configured PostgreSQL database use those external systems directly. The local CLI and library do not proxy data through a supaschema-operated service. Last modified on July 24, 2026
