Privacy

Email addresses

TakeApart has no updates list, so it collects no email addresses. There’s nothing to delete, so there’s no deletion page. Questions go to chestrbrian@gmail.com.

Imports

An uploaded file is read in the browser. Only the package list, and the PHP, Node or Python version the files pin or allow with the kind of file it came from, is sent to TakeApart’s server, never the file. “Try your own” keeps nothing that identifies an import. The result is shown in the browser and isn’t saved. Reloading the page clears it. Lookups for its packages are cached for up to three days, shared and without who asked.

Vulnerability lookups

To find known vulnerabilities, TakeApart’s server sends the names and versions of an import’s packages to OSV, a vulnerability database run by Google. The names of packages with known vulnerabilities also go to their ecosystem’s public registry (the npm registry, Maven Central, PyPI, Packagist, RubyGems, crates.io, NuGet or the Go module proxy), to check which versions are published, so a fix is never a version that doesn’t exist, and for a package no version fixes, to read its latest release and the day it was published. The vulnerability ids found go to FIRST’s EPSS service for exploitation scores. The CISA KEV catalog, Metasploit’s module list and the nuclei-templates CVE list are downloaded whole every six hours, from CISA and GitHub, so they receive nothing about an import. The project’s own name, private packages (from a registry other than the public one) and packages that don’t come from a registry at all (a local path, a URL or an editable install) reach TakeApart’s server with the rest of the package list, but they’re never sent to these services. They show as “Private, not checked” and “Not checked”.

Runtime vulnerability data for PHP, Node and Python comes from OSV’s Bitnami records, php-src’s vulnerability reports on GitHub, the Node.js security team’s vulnerability list, CVE.org, FIRST’s EPSS scores and endoflife.date. TakeApart’s server reads them whole every six hours, so they receive nothing about an import, and the runtime version an import pins or allows never leaves TakeApart’s server.

Every 10 minutes TakeApart’s server checks GitHub and OSV for new and changed public vulnerability data. It asks only for public advisory data, and nothing about any app, import or visitor goes to GitHub or OSV because of it.

Explanations

Opening a fix-now or plan finding on an import asks TakeApart’s server for its explanation, by vulnerability id and package version. Anthropic receives public vulnerability data and the package’s name and version to write it, never which application it belongs to or anything about the visitor. Explanations are stored per vulnerability and package version for 60 days and shared with every visitor who opens the same finding. They hold nothing about who asked.

Repository paste

A pasted repository is read by TakeApart’s server through GitHub’s or GitLab’s public API. It reads only the root lockfile and manifest, a pinned requirements file, go.mod, gradle.lockfile or an SBOM on the default branch, clones nothing and stores nothing. For the runtime’s version it also reads a version file (such as .nvmrc or .php-version), the Dockerfile and up to five GitHub Actions workflows. A requirements directory’s base.txt or prod.txt counts as a requirements file. What goes to the vulnerability services is the same as for an upload. TakeApart stores neither the address nor the files. Vercel’s request logs keep the result’s /r/ address and the outgoing API requests for a day. The result’s link holds the address so the repository can be read again.

Upgrade impact

Opening Impact on a fix sends TakeApart’s server the import’s package list again, with the version ranges its lockfile and manifest declare and the PHP or Node version range the manifest allows. The server looks up the package and the packages that would move with it in Packagist (for Composer) or the npm registry, by public name, to read their releases and requirements. Neither registry learns which application asked. Nothing from the import is stored. Release data is cached per public package for up to two days and shared. Private packages are never looked up.

Usage counts

The site keeps daily totals of a few anonymous actions. It counts clicks on the landing page’s two buttons and imports started, finished and failed, by file type or repository paste and by a failure reason such as too large. In the demo and in imports it counts cards opened, fix-list clicks, uses of isolate and upgrade preview and copied share links. Time on the model and time on the fix list and Summary are counted only as a range, such as 2 to 5 minutes, sent once when the page closes. Each count is a name and a number for the day. An import is counted by where it came from (an upload, a pasted repository or the demo), the kind of file it read (such as package-lock or go.mod, never the file’s name) and, if it failed, why. The counts carry no IP address, identifier or cookie. Nothing is stored on the device for the counts. No package, project or repository name is recorded. To stop floods, the counter uses a keyed hash of the IP address that’s kept in memory for an hour and never stored with the counts. Each count also says whether the page was phone-sized or larger, worked out in the browser from the window’s width (narrower than 768 pixels is a phone). Only “phone” or “desktop” is sent. The width, screen size, browser, operating system and user agent are not recorded.

Rate limits

To rate limit imports, repository pastes, new explanations and upgrade impact lookups, a keyed hash (HMAC) of the IP address is recorded with the time in TakeApart’s Supabase database in Seoul (ap-northeast-2), never the address itself. The records are deleted after 24 hours. The event counter’s limit is kept in memory for an hour. Upgrade impact lookups are counted separately from imports, with a higher limit, because each import asks for them on its own.

How long

• Rate-limit records (a keyed IP hash and the time) are deleted after 24 hours.
• Cached public vulnerability lookups are deleted within three days.
• Event counts are daily totals with no identifier and are kept with no end date.
• Explanations are deleted after 60 days.
• Records of new and changed public vulnerability data, and the unreviewed and malware entries kept for matching, are deleted after 90 days.

Scheduled database jobs do the deleting, every hour for the 24-hour rules and once a day for the others.

Hosting logs

Vercel hosts the site. Imports, lookups and everything TakeApart stores are processed in Seoul (icn1), next to the database, and pages and static files are served from Vercel’s network. Vercel processes request logs, which include IP addresses, the pages requested (such as a repository result’s /r/ address) and outgoing API requests. On TakeApart’s plan they’re kept for a day. See Vercel’s runtime logs documentation.

Nothing sold or shared

Nothing is sold or rented, or shared beyond the services named on this page.