Security and data

What stays on your machine, what can leave it and how to check it.

Pages in this section

• Data handling and privacy

  No telemetry and no silent self-update. The eleven flows of the npm package that can send data off your machine, each with what, to whom, when and under which consent, plus what stays local.

• Trust, ownership and licences

  Who wrote what, which licences apply, which files BMAD+ owns in your project and how it proves it, what update and uninstall keep, how OSINT is governed, and where the notices live.