Skip to main content

What leaves the machine

A search sends the query, the stored key and a small trace to the router, and nothing else, to nowhere else. Here is each part, and the switch that turns the trace off.

The search request​

An agent sends the query as JSON on stdin, so it is in neither the process list nor a shell history. The human form, jevlin search "<query words>", puts the query on the command line, where both can see it; use --stdin for anything sensitive. See Search from a shell.

The key travels in the request's Authorization header and nowhere else. It is never put in a command line, an agent's config, or a skill.

The trace​

Each search carries a trace: the agent's session, turn and call ids, hashed with SHA-256 before they leave the machine, a window and call counter, and the assistant text just before the search, capped at 32 KiB. That text is conversation content leaving your machine, and it goes only to the search router, inside the search request. Nothing else reads it.

The scrub​

Before the assistant text is cut to size it is scrubbed. In plain language, the scrub removes:

  • anything with a credential's shape: API keys, Stripe secret keys, GitHub and AWS tokens, JWTs, a password inside a URL;
  • the credential after an Authorization or Proxy-Authorization header's Bearer, Basic or Token, whatever its shape, as a header line or as curl -H writes it; a variable such as $TOKEN or a placeholder such as <token> stays;
  • a PEM private key block whole, markers included, even one cut short;
  • email addresses;
  • the account name in a home path, after /home/, /Users/ or C:\Users\, and in the dashed spelling Claude Code gives a project's folder (-Users-<account>-);
  • any value under a name like password, secret, token, credential or api_key, however it is written: after =, after a colon in YAML or JSON, or as the word after a flag such as --password;
  • every value in an environment listing of five or more variables;
  • this machine's hostname, and your account name where the text uses it as an account.

It is a filter over text a model wrote, not a guarantee: a secret with no telling name and no known shape, in ordinary prose, passes. The trace states every rule and every known gap. The text is scrubbed before it is cut, and an entry too large to scrub whole is omitted whole. A crash while preparing the trace costs the trace, not the search: the search goes without it and says so on stderr.

The turn end​

With [miner] turn_end = true, the end of a turn that searched sends what you asked and what the assistant concluded, scrubbed the same way, plus each tool's name, duration and outcome. Never a tool's input or output, never a file's contents, never a command or its result. It goes only to the router, and only for a turn in which a search was served. See The turn end.

With mining on​

If you turned mining on, each search is recorded on your machine and reported to the rewards service after the fact. The rewards service receives metadata only: request ids it can check with the search platform, never the query, the results or the text. See Earning with mining.

Sending less​

export JEVLIN_TRACE=off

No trace and no turn end. Searches work the same, are metered the same, and earn the same. The hooks still run, but they send nothing.

Lineage files stay under ~/.jevlin/sessions, and only the agent that wrote one reads it. They are safe to delete with no agent running; the hooks write them again.