Privacy and security
What stays on your machine, exactly what leaves it and where it goes, and how secrets are protected.
No Telemetry
canvas-cli collects no telemetry, analytics, or usage data. It has no crash reporter, no update check, and no service of its own to talk to. Every network request it makes is to one of the places listed below. If analytics are ever added, they will be opt-in and announced before any data is collected.
It is also read-only against Canvas. canvas-cli only ever reads: it cannot submit an assignment, post, or change anything in your account.
What Stays
| Location | Contents |
|---|---|
~/.config/canvas-cli/ | Profile settings, and your Canvas token and AI keys when the file store is used. On macOS these secrets are usually in the Keychain instead; canvas-cli status shows which. |
.canvas-cli/ | Downloaded course material, extracted text, your grader feedback, workspaces, conversations, and exports, in the folder you run canvas-cli from |
.canvas-cli/ is readable only by your user account. canvas-cli creates it that way, and tightens an existing one the next time it runs there.
What Leaves
| Destination | What is sent | When |
|---|---|---|
| Your school's Canvas | Your Canvas token, in the Authorization header, with read-only requests | When the shell starts and syncs, and whenever you open or ingest a course |
| Your AI provider (Anthropic, OpenAI, Google, or AWS) | Your API key, the conversation so far, and the course text the assistant reads or you pin, which can include your own grader feedback | Asking questions, preparing workspaces, /quiz, and /pdf |
| GitHub or OpenAI, through the copilot or codex CLI | The same prompt content, sent by the vendor's CLI under your own login | Only with AI_PROVIDER=copilot or codex |
| Websites your course links to | An ordinary request for the page or document, with no credentials | During ingestion, to capture linked documents |
| Your AI provider's API, as a key check | Anthropic: a one-word message capped at one output token. OpenAI and Google: a request listing models. Bedrock keys are not checked | Only when you run /doctor |
Your Canvas token only goes to your Canvas site. Canvas may redirect a file download to its own file storage; the token is not forwarded there. Links in course content that point back to your Canvas site are fetched with your token, like any other Canvas request; links anywhere else never are. Like any app using your token, these requests may appear in Canvas’s access logs.
Opening a file or lecture hands it to your operating system’s default app (open, xdg-open, or start). Signing in can open your Canvas settings page in the browser. Installing Tectonic for /pdf runs your package manager, only after you choose to, and Tectonic downloads its own support files the first time it runs.
Secrets
- On macOS, the Canvas token and API keys are stored in the Keychain. canvas-cli reads the token and keys back after saving them, and removes any older plaintext copy once the Keychain has it. Secrets are handed to the
securitycommand on its input, never as a command-line argument, so they do not show up in the process list. - Elsewhere, or if the Keychain is unavailable, they are stored in files readable only by your user account, in a folder readable only by you.
- The sign-in wizard hides the token and keys as you type them, and
statusonly ever says whether one is configured. - A Canvas address set in the environment is never combined with a stored token, so a
.envfile cannot redirect your saved Canvas token to another server. See .env files. - AI keys get the same protection. When
ANTHROPIC_BASE_URLorOPENAI_BASE_URLis set, the matching key must be set in the environment too; a key saved byloginis never sent to a redirected address. - File names from Canvas are sanitized before anything is written to disk, and zip archives are unpacked with size limits.
Subscription CLIs
When you use GitHub Copilot or ChatGPT through their CLIs, each request starts the CLI in a new, empty temporary folder that is deleted afterwards. The only Canvas access it gets is canvas-cli’s own tools, offered over a server that listens on 127.0.0.1 only and rejects any request without a random token created for that one request. The tools themselves run inside canvas-cli.
- Copilot: its shell, file, and web tools are removed, and its built-in integrations and your custom instructions are turned off. It keeps its normal session history and any integrations you added to Copilot yourself.
- Codex: runs in a read-only sandbox with web search off, without saving a session, and ignoring your Codex config. It keeps its command tool, which can read files but not change them.
Debug Output
--debug (or DEBUG=canvas-cli) writes diagnostic detail to stderr and nowhere else. Tokens, API keys, passwords, authorization headers, and sensitive URL parameters are replaced with *** before anything is printed:
canvas-cli --debug ingest ECE216 2> debug.logThe log still names your school, your courses, and file paths that include your username, so read it before posting it anywhere public.
Reporting a Problem
Found a security problem? Please don’t post the details in a public issue. Open an issue asking for a private way to share them, and the maintainer will follow up.