0xallam
4357648404
The SDK ships its own tracing pipeline (``agents.tracing``) plus ``SQLiteSession`` for native conversation persistence. Strix's custom OTEL bootstrap + Traceloop integration was dead weight — the SDK does not bridge to OpenTelemetry, so all of our adapter code was solving a problem we didn't actually need solved. Telemetry purge: - Drop the ``traceloop-sdk`` and ``opentelemetry-exporter-otlp-proto-http`` runtime deps. ``uv sync`` uninstalls ~30 transitive packages (the OTEL family, ``traceloop-sdk``, ``protobuf``, ``opentelemetry-exporter-otlp-*``, ``deprecated``, ``wrapt``, ``backoff``, etc.) — about 1000 lines off ``uv.lock``. - Delete ``bootstrap_otel`` and ``JsonlSpanExporter`` from ``telemetry/utils.py``; strip the OTEL pruning helpers, ``parse_traceloop_headers``, ``default_resource_attributes``, ``format_trace_id`` / ``format_span_id`` / ``iso_from_unix_ns``. Keep only the sanitizer + JSONL writer + write-lock registry. - Strip ``Tracer._setup_telemetry``, ``_otel_tracer``, ``_remote_export_enabled``, ``_active_events_file_path``, ``_active_run_metadata``, ``_get_events_write_lock``, ``_set_association_properties``. ``_emit_event`` now generates trace/span ids from ``uuid4`` directly. - Drop the ``traceloop_base_url`` / ``traceloop_api_key`` / ``traceloop_headers`` / ``strix_otel_telemetry`` config knobs. - Rename ``is_otel_enabled`` → ``is_telemetry_enabled`` (the gate now controls JSONL emission only). Native session resume: - ``entry.py`` now constructs an ``agents.memory.SQLiteSession`` keyed by ``scan_id`` and persists conversation history at ``strix_runs/<scan_id>/session.db``. A second call to ``run_strix_scan`` with the same ``scan_id`` resumes from where the prior run left off — no manual state plumbing needed. Tracer.agents fix (TUI agent tree was silently empty): - ``StrixOrchestrationHooks.on_agent_start`` now mirrors bus state into ``tracer.agents`` (id / name / parent_id / status), and ``on_agent_end`` flips the entry to ``completed`` / ``crashed``. The TUI now actually shows the agent tree during scans. Tooling: - Drop ``pylint`` from dev deps; ``ruff`` covers everything we used it for. Strip the ``make lint`` pylint step.
Overview
To help make Strix better for everyone, we collect anonymized data that helps us understand how to better improve our AI security agent for our users, guide the addition of new features, and fix common errors and bugs. This feedback loop is crucial for improving Strix's capabilities and user experience.
We use PostHog, an open-source analytics platform, for data collection and analysis. Our telemetry implementation is fully transparent - you can review the source code to see exactly what we track.
Telemetry Policy
Privacy is our priority. All collected data is anonymized by default. Each session gets a random UUID that is not persisted or tied to you. Your code, scan targets, vulnerability details, and findings always remain private and are never collected.
What We Track
We collect only very basic usage data including:
Session Errors: Duration and error types (not messages or stack traces)
System Context: OS type, architecture, Strix version
Scan Context: Scan mode (quick/standard/deep), scan type (whitebox/blackbox)
Model Usage: Which LLM model is being used (not prompts or responses)
Aggregate Metrics: Vulnerability counts by severity, agent/tool counts, token usage and cost estimates
For complete transparency, you can inspect our telemetry implementation to see the exact events we track.
What We Never Collect
- IP addresses, usernames, or any identifying information
- Scan targets, file paths, target URLs, or domains
- Vulnerability details, descriptions, or code
- LLM requests and responses
How to Opt Out
Telemetry in Strix is entirely optional:
export STRIX_TELEMETRY=0
You can set this environment variable before running Strix to disable all telemetry.