Make building, testing, shipping, and automation smoother

BEFORE YOU USE IT

The installer writes skill files into a project or user directory and can add a project hook that runs after UI edits; Codex still requires separate approval for that hook. The privacy policy says project files, prompts, and detection results are not sent to Impeccable, but a daily version check, a request for candidate visual directions, and an optional note of the selected direction may occur unless disabled. A design-direction description is sent to OpenAI only when OPENAI_API_KEY is configured. The current skill release is 4.0.2 while the npm CLI reports 3.3.1, and rule counts differ across the README, site, and changelog, so check the artifact you actually install. Its aesthetic rules are opinionated and do not replace user testing, accessibility audits, performance measurement, or brand judgment.

BEFORE YOU USE IT

Review content and related code context are sent to the model service you configure; use a local or private endpoint you have verified if code must not leave your environment. Sessions are stored locally. The npm launcher may auto-update by default, so pin a version or disable updates, and inspect the remote installer before running it. Current repository telemetry docs say telemetry is off by default and prompt or response content is not exported, while the npm page still contains older content_logging wording; follow the docs and code for the version you install. The benchmark is first-party and shows lower recall, and CI adoption still requires reviewing token permissions, secret scope, and requests from forks.

BEFORE YOU USE IT

The website privacy page says only short snippets are sent and the daemon has no analytics, while the GitHub privacy file says it reads agent output, sends some text to TTS and Anthropic, and enables PostHog and usage telemetry by default. Those statements are not aligned. Installation instructions also remove the macOS quarantine flag. Managed subscriptions auto-renew and are generally non-refundable. Before using client code, secrets, or full logs, confirm the actual data path, disable optional telemetry, and test only on a low-risk repository.

BEFORE YOU USE IT

The 85%–90% token savings come from maker claims and one task estimate, not a general result; the store has no ratings and the product is still early. The extension uses high-impact permissions including debugger, nativeMessaging, and all-sites access, and can execute short JavaScript in pages, so local does not mean low risk. Code uses Business Source License 1.1 (BSL 1.1), and commercial use must follow the license.

BEFORE YOU USE IT

Air remains a public preview; models, permissions, execution location, and cost depend on JetBrains AI, BYOK, or external agents, and worktree isolation does not keep code on-device by itself. Agents can edit files, run commands, and consume quota, so review every diff, permission, and network path. Use the live download page for platform availability; stability and privacy remain untested.

BEFORE YOU USE IT

'All tools run locally' applies only to some browser tools; registration, marketplace, DNS, monitoring, analytics, and error reporting use remote services. Annual price, watched-domain counts, and unlimited-query language differ across pages, while MCP has a 30-per-minute limit. Domain, price, and certificate data are best effort, so verify important results at the source; some links earn affiliate commissions.

BEFORE YOU USE IT

Site, pricing, SDK, and live-manifest numbers differ for tools, APIs, allowances, and versions, so use the live manifest and current pricing. Tools are not all read-only: some create pastes or short URLs and query external URL/DNS services, so review each before agent access. Pastes may persist for 24 hours, short-link retention is unclear, and the API is not entirely account-free or free.

BEFORE YOU USE IT

This is early access: version, rule count, classifier, and proxy descriptions differ across pages, with no public checksum or changelog. Individual is described as local, while team mode uploads events and redacted snippets; Investigation Mode, keys, retention, and employee rights need clarification. Privacy and terms remain drafts and SOC 2/HIPAA are incomplete, so buyers should confirm the DPA, price, and contract.

BEFORE YOU USE IT

Full prompts, outputs, tool arguments/results, and error context are captured by default, so redaction must be configured before use; error text may still expose sensitive material. Public sources conflict on license and framework counts, so use the current Apache-2.0 repository and compatibility matrix. Hosted cloud, custom collectors, and self-hosting are distinct boundaries, and buyers should request compliance evidence and region details.

BEFORE YOU USE IT

Public pages conflict on outbound-link and anchor checks, and honoring target-site robots.txt is still listed as future work; do not scan a site without authorization. Privacy information does not explain retention or deletion for target URLs, scan results, and alerts. History access, annual discounts, and the official domain are also inconsistent.

BEFORE YOU USE IT

The site's Safari, Internet Explorer, and Edge support statements conflict, so rely on the live store before installing. The extension can read page, tab, and navigation data and may request all-sites access. Privacy text does not map store data categories or site analytics clearly, and customer logos lack public sourcing.

BEFORE YOU USE IT

The site exposes no public privacy policy or terms, leaving license validation, site analytics, and support-chat data unclear. The no-telemetry app still checks its license online, while signing, notarization, and recovery lack public installer evidence. Filename-only secret checks cannot replace content scanning, and automatic cleanup should first be tried on a recoverable copy.

BEFORE YOU USE IT

A hash proves integrity, not publisher identity, licensing, or safety, and public asset metadata lacks a license field. CLI, trust-manifest, and GitHub versions differ, and the latest package cannot be reproduced directly from the public repository. Default telemetry creates a persistent machine identifier and sends limited metadata without exact retention or deletion details.

BEFORE YOU USE IT

Code and prompts bypassing the backend does not mean zero data flow: usage events, Sentry crashes, optional accounts, and Swarmi help messages go online. The policy gives no fixed deletion period for analytics, errors, or support messages. In Turbo Mode, Ask behaves as Allow when confirmations are skipped, so actions that must never auto-run need Deny.

BEFORE YOU USE IT

'Docs stay in GitHub' does not mean zero processing: the App needs repository-content and pull-request write access, and collaboration state may persist for up to seven days. AI requests send relevant text and comments to xAI, which may retain them for up to 30 days. Product analytics and operational logs have separate retention and should be reviewed before granting private-repository access.

BEFORE YOU USE IT

The product remains at 0.5.x and hosted publishing is in closed beta. We have not installed it to test no-telemetry, local-key, or source-bounded-answer claims. Publishing stores account, content, conversation, and usage data, and the site's analytics script conflicts with its privacy text.

BEFORE YOU USE IT

The ~200 ms result and zero-conversion-loss claim were not reproduced by us, and low-power devices or hostile traffic may behave differently. Injected ARIA cannot replace keyboard, screen-reader, and human accessibility testing. The 99.9% figure is a target; business users should also review processors, retention, and the DPA.

BEFORE YOU USE IT

The empty canvas has limited onboarding and prototype-level recovery. Custom API keys and multi-provider support create security, cost, and protocol-change risks, while a front-end-only model limits persistence and collaboration.

BEFORE YOU USE IT

A short assessment can guide learning but cannot replace review of real project work, code quality, or collaboration. Scoring needs transparent rationale and should not become a permanent label.