Safety & Privacy

gitcomm sends code to a service to produce suggestions, so it is worth knowing exactly what leaves your machine.

What is sent

A truncated, redacted slice of your staged diff. Lockfiles and generated files are excluded, file contents are cut to a length budget, and content matching common secret patterns is removed before the request is built.

gitcomm also sends the style summary it derived from your history, since that is what shapes the suggestions.

Inspect the prompt

Before trusting a service with your diff, read what it gets. --echo prints the prompt and exits without contacting anything:

npx gitcomm --echo
npx gitcomm --echo --full

--full includes the whole diff instead of the truncated version, which is what you want when you are checking whether anything sensitive survived redaction.

Keep it local

--offline skips the service entirely and uses the rule-based engine:

npx gitcomm --offline

Suggestions are derived from file paths, roles, and your commit style. They name the unit that changed, such as feat(task): add task controller, but they cannot read inside the files, so they are more generic than service-generated ones.

Running your own service

The service URL is configurable, so you can point gitcomm at your own deployment:

npx gitcomm --api-url https://gitcomm.internal.example

--verbose reports which provider served a request and how long it took, which is the quickest way to confirm your override took effect.