From 0c1be642e16319c4412c83f2dad6cf931e900287 Mon Sep 17 00:00:00 2001 From: Aman Sharma Date: Sun, 25 Oct 2026 12:39:36 +0100 Subject: [PATCH 1/2] chore: Add a privacy policy and link it from the plugin manifest Co-Authored-By: Claude Opus 5.5 --- .claude-plugin/plugin.json | 1 + PRIVACY.md | 13 +++++++++++++ 2 files changed, 14 insertions(+) create mode 100644 PRIVACY.md diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 33f00d8d..36e3a832 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -8,5 +8,6 @@ "homepage": "https://github.com/chains-project/yul", "repository": "https://github.com/chains-project/yul", "supportUrl": "https://github.com/chains-project/yul/issues", + "privacyPolicyUrl": "https://github.com/chains-project/yul/blob/main/PRIVACY.md", "license": "MIT" } diff --git a/PRIVACY.md b/PRIVACY.md new file mode 100644 index 00000000..f3246de1 --- /dev/null +++ b/PRIVACY.md @@ -0,0 +1,13 @@ +# Privacy + +yul runs on your machine. It has no telemetry and sends nothing to the chains-project maintainers. + +To check a dependency, yul asks its public registry for the latest version. The request carries the package name. It does not carry file contents, file paths, or source code. The registries are Maven Central, PyPI, npm, the Go module proxy, crates.io, and the GitHub API for Actions. Some lookups go to packages.ecosyste.ms instead. yul does not skip private packages, so an internal package name in a manifest is looked up like any other. Each of these services handles requests under its own privacy policy. + +For GitHub Actions, yul uses a GitHub token if one is available in `GITHUB_TOKEN`, `GH_TOKEN`, or `gh auth token`. It sends the token only to api.github.com, to raise the rate limit. + +The Claude Code plugin also contacts GitHub at session start. It downloads the pinned yul release and checks whether a newer one exists. + +yul stores its binary and its scan results under `~/.cache/yul/` (or `$XDG_CACHE_HOME/yul/`). Scan results list outdated dependencies per project. Deleting the directory removes them. + +Questions go to https://github.com/chains-project/yul/issues. From 3781f9b94f40af20774985501061f31a9f2253ab Mon Sep 17 00:00:00 2001 From: Aman Sharma Date: Sun, 25 Oct 2026 12:45:47 +0100 Subject: [PATCH 2/2] chore: Link each registry host in the privacy policy Co-Authored-By: Claude Opus 5.5 --- PRIVACY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/PRIVACY.md b/PRIVACY.md index f3246de1..4f7f56f4 100644 --- a/PRIVACY.md +++ b/PRIVACY.md @@ -2,7 +2,7 @@ yul runs on your machine. It has no telemetry and sends nothing to the chains-project maintainers. -To check a dependency, yul asks its public registry for the latest version. The request carries the package name. It does not carry file contents, file paths, or source code. The registries are Maven Central, PyPI, npm, the Go module proxy, crates.io, and the GitHub API for Actions. Some lookups go to packages.ecosyste.ms instead. yul does not skip private packages, so an internal package name in a manifest is looked up like any other. Each of these services handles requests under its own privacy policy. +To check a dependency, yul asks its public registry for the latest version. The request carries the package name. It does not carry file contents, file paths, or source code. The registries are Maven Central ([repo1.maven.org](https://repo1.maven.org)), PyPI ([pypi.org](https://pypi.org)), npm ([registry.npmjs.org](https://registry.npmjs.org)), the Go module proxy ([proxy.golang.org](https://proxy.golang.org)), crates.io ([crates.io](https://crates.io)), and the GitHub API for Actions ([api.github.com](https://api.github.com)). Some lookups go to [packages.ecosyste.ms](https://packages.ecosyste.ms) instead. yul does not skip private packages, so an internal package name in a manifest is looked up like any other. Each of these services handles requests under its own privacy policy. For GitHub Actions, yul uses a GitHub token if one is available in `GITHUB_TOKEN`, `GH_TOKEN`, or `gh auth token`. It sends the token only to api.github.com, to raise the rate limit.