Security
The short version
LATdx runs on your machine and talks directly to your Salesforce org. Nebulity, LLC operates the licensing and billing service; it is never in the path between your machine and your org.
What never reaches our servers
- Apex source code
- Salesforce records
- SOQL query results
- Salesforce credentials or session tokens
- Org metadata XML
The dependency graph, fingerprints, and cached results are computed locally and stored locally under ~/.latdx. Parsing happens on your machine; source is never uploaded for analysis.
What the CLI does send
Anonymous usage telemetry, on by default, so we can prioritise the product and diagnose failures without asking you for logs:
- Which command ran, and its exit code
- Counts only: tests requested, passed, failed, skipped, cached
- Timings: wall-clock duration, cache hit rate, time saved
- Environment: OS, architecture, CLI version, Node version, whether the run was in CI
- Resolution health counters: classes requested, resolved, missing in org
These are counts and timings only. Test names, class names, org identifiers, file paths, and source code are not included.
Turn it off in any of three ways:
latdx config set telemetry off # persisted in ~/.latdx/config.json
LATDX_TELEMETRY=0 latdx test run # per shell
DO_NOT_TRACK=1 latdx test run # per shellTelemetry never blocks or slows a command. If the network is unavailable it is dropped silently.
Salesforce org access
LATdx authenticates to your org using the Salesforce CLI connection you already have. Credentials are read from your local Salesforce CLI configuration and used to call the org directly. We do not proxy, store, or transmit them.
GitHub App scopes
The optional LATdx GitHub App is used to detect your Salesforce repositories and open a pull request that adds the CI workflow. It requests repository contents and pull request permissions for the repositories you explicitly select during installation. It does not require organisation-wide access, and you can revoke it at any time from your GitHub settings.
You do not need the GitHub App to use LATdx. The CLI works standalone; installing the App only automates the CI setup step.
Correctness of cached results
With Java 11 or newer and the LATdx daemon running (the normal setup), LATdx fingerprints each test method from the Apex it reaches through static calls plus the project's object and tracked metadata files, and reuses a stored result only while that fingerprint is unchanged. If either is missing, LATdx falls back to one key per test class, built from that class's own code, so metadata edits go unseen and edits to the classes it calls usually do too. A test whose key LATdx cannot compute runs on the org, and its result is not stored. Changes to code called by name at runtime (such as Type.forName) or to metadata LATdx does not track do not invalidate stored results. In the normal setup, tests still run against the org's code, so a run made before you deploy a local edit stores the old code's result under your edited code's fingerprint. After such a change, or after deploying an edit you already ran tests against, re-run the tests that depend on it with --force: name them with -n or -t, or run the full suite.
If you believe LATdx served a cached PASS for a test that should have rerun, report it via contact. We treat cache-correctness reports as the highest-severity class of bug.
Payments and account data
Payment details are processed by Stripe and are never stored by Nebulity. Account data (email, subscription state) is described in the Privacy Policy.
Reporting a vulnerability
Email security@latdx.com with details and reproduction steps. We aim to acknowledge within two business days. Please do not open a public GitHub issue for security reports.