Where your data is kept

One folder

Debugt keeps everything under ~/.debugt in your home folder. Set the DEBUGT_HOME environment variable to move it.

~/.debugt/
  settings.json                 your settings
  shares.json                   the links you have shared, to copy again or revoke
  added-folders.json            folders you added as projects, from inside the ones open in VS Code
  projects/
    <project>/                  one folder per project
      project.json              which repository it belongs to
      canvases.json             the canvases made in this project
      hosts.json                each service's host
      service-*.json            each service's kind, handler, protocol and ready pattern
      capture.json              what is not captured, and what is redacted
      profiles.json             environment profiles — their variables, values included
      overrides.json            the project's override library
      broker.json               the message broker's address, if you set one
      team.json                 what this machine last agreed with its team about the requests
      team-setup.json           and about the canvases, profiles, overrides and redaction rules
      requests/                 saved requests, a folder per service
      history/                  Request History: one <id>.json per send — its request,
                                response, hops and recordings — and the list and trash
      console/                  the canvas console's log, one file a day, kept a week

profiles.json holds whatever your environment profiles hold — hosts, keys, passwords for a staging database. It is on this machine only, and never in a repository.

A project’s folder is named after the repository’s folder and a hash of its path. Moving or renaming a checkout therefore makes it a new project; rename the stored folder to carry its data across.

Nothing is written into the repositories you are debugging. No config file, no ignore entry, no generated code.

What is in a trace

A trace holds real payloads: the request and response of every hop, and the values your code handled while it ran. That is why it lives outside your repository, where it cannot be committed by accident.

Credentials are removed before a hop is even recorded: Authorization, Cookie, X-Api-Key and similar headers, and query parameters that carry a key or token. Bodies are kept up to a size limit and cut short past it.

Each project can take out more, under Settings → Redact:

• Headers of your own, such as a tenant or session token.
• Body fields — access_token, password — anywhere in a JSON or form body, in what traces and Request History keep.
• Recorded variables — ssn, username — in what a recording keeps, taken out in the service itself, so the value never leaves it. password, secret, token and the like always are.

What leaves your machine

• On the Free plan: nothing, unless you share a send. No account, no activation, no usage data, no crash reports.
• With a license: a daily check that sends the license token, a hash of your machine’s id and the extension’s version.
• A send you share, when you share it: encrypted on your machine first, with the key only in the link — see Sharing a send.
• What you share with your team, in the Teams beta: the saved requests, canvases, profiles, overrides and redaction rules you choose to share, each encrypted on your machine with your team’s key, which Debugt’s servers do not have — see Teams. A profile’s personal variables go by name, never by value. Signing in to join a team also sends your email address, and your machine’s public key.

Nothing is shared any other way.

The full list is on the privacy page.

Requests you send from the runner go only to addresses on your own machine: localhost and 127.0.0.1. Debugt will not send one anywhere else, so it cannot be used as a way to reach whatever your computer can.

The page in your browser

Debugt’s interface is a page served from your own machine, at http://127.0.0.1:4400 by default. It is not on the internet: the server listens only on the loopback address, and it checks where each request comes from, so another website open in your browser cannot call it.

Deleting added-folders.json, or the whole folder, forgets the projects you added with Add projects from folders: add them again, or a canvas whose services are in them finds none.

Removing everything

Uninstall the extension and delete ~/.debugt. Nothing else was created.