Skip to content
Docs · Documentation

Reference

Updates and privacy

How Kubyl updates itself, what it connects to and what it stores.

Self-update

Kubyl checks for a new version every 6 hours (self_update.auto_check), but only when it was installed manually from a .dmg, .zip or .tar.gz. The update is verified before it is used:

  • The update manifest comes from the project's GitHub releases and its ed25519 (minisign) signature is checked against a key embedded in the app.
  • The artifact's SHA-256 is checked against the manifest.
  • On macOS the signing identity is pinned and codesign --verify --deep --strict runs on the new app before it replaces the old one.

The download happens in the background. A status-bar item then reads “restart to update to vX.Y.Z”. Kubyl never restarts by itself.

Homebrew, winget, apt, dnf, pacman, Flatpak and snap installs skip self-update, and the update hint names the right command, for example brew upgrade --cask kubyl.

Telemetry

Kubyl has no telemetry. There is no analytics and no crash reporting, and no account. Outside of the clusters and endpoints you configure, the only network call Kubyl makes on its own is the update-manifest check, which you can turn off. Everything else that leaves your machine is something you start, and the next section lists it.

What leaves your machine only when you ask

  • AI agents. Kubyl never installs or calls a model. When you start a thread, your own agent program (Claude, Codex, Gemini CLI and so on) receives what you type and what its Kubyl tools return, and sends it to its provider under that provider's terms. Secret values are masked first; masking of free text is best-effort. See AI agents. Nothing is sent when you click an Ask question until you press Enter.
  • Helm. Your helm talks to the chart repositories and registries you configured. Artifact Hub is searched only if you set helm.artifact_hub.
  • Cloud discovery and import run your installed aws, gcloud and az CLIs, which contact the cloud providers. Kubyl stores no results. Available in the release after 0.6.0 for discovery.
  • Security Center and Cost read Trivy Operator reports and OpenCost through your cluster's API server. They call no outside service. Available in the release after 0.6.0.

What is stored

  • Tokens, refresh tokens, client keys and Secret data are never written to settings.json or state.json, and are never logged.
  • Secret values are masked in the YAML editor, in Copy YAML and in Helm values, until you reveal them.
  • Alerts, network flows, Prometheus queries and log contents are not saved to disk.
  • The YAML editor's revision history never records Secrets.
  • Agent threads are stored as a title and a session id so the agent can reopen them. Transcripts are not saved by Kubyl, and titles are scrubbed of tokens.
  • A CSV export of a Secret list holds key counts, never values.
  • A Helm repository password is the exception: helm repo add stores it in Helm's own file, as it does without Kubyl. See Helm.

The website's privacy page covers kubyl.dev itself.

Something missing or wrong? Open an issue on GitHub.