Developer tool collectors — import-based early access

Only collect software and data you own or are authorised to inspect. These tools do not modify targets. Output paths must not already exist. Python collectors require Python 3.10 or later; npm inventory requires Node 20 or later. GitHub collection requires the official GitHub CLI signed in to an account with access to the selected repository.

GitHub timeline:
  python3 github_timeline.py --repo OWNER/REPO --incident-at 2026-09-22T10:00:00Z --service YOUR_SERVICE --environment repository --output changes.json

Use the actual first-symptom time. Collection covers at most the latest 100 commits and 100 workflow runs. Commits are tagged repository, not production; workflows are tagged ci. Add verified deployment and configuration events for production incident investigation. Import changes.json into ChangeTrace.

npm dependency inventory:
  node npm_inventory.mjs package-lock.json inventory.json

To query OSV, explicitly add --query-osv. This sends package names and exact versions to https://api.osv.dev, not source code. A v2/v3 package-lock is required. Missing or incomplete lookups remain unknown. Import inventory.json into Dependency Guardian. Source: https://google.github.io/osv.dev/post-v1-querybatch/

Configuration fingerprints:
  python3 config_snapshot.py --input baseline-config.json --key private-fingerprint.key --create-key --environment staging --output baseline.json
  python3 config_snapshot.py --input current-config.json --key private-fingerprint.key --environment staging --output current.json

Input files are local JSON objects mapping names to values. They may contain secrets: never upload them. Keep private-fingerprint.key private; do not upload it or commit it to source control. Use the same key and environment for both snapshots. Create a new JSON object containing {"baseline": <contents of baseline.json>, "current": <contents of current.json>} and import that combined file into ConfigGuard. Only names and keyed fingerprints are emitted. On Windows, ensure your account is the only account that can read the key file.

iOS metadata:
  python3 ios_metadata.py /path/to/Your.app metadata.json

This expects an extracted iOS .app, not a macOS .app or an IPA archive. It reads Info.plist without executing the app. Add privacyPolicyUrl, createsAccounts and accountDeletion based on actual app behaviour, then import metadata.json into StoreShield. It does not inspect embedded SDK binaries or guarantee store approval.

Data Integrity Sentinel, Release Guardian and Bug Capsule:
Use Download input template in the corresponding tool. Replace all example data with a reviewed export from your own system. Analysis is performed locally in the browser. Save uploads only the displayed report after your explicit confirmation. Reports may retain identifying information; review before saving or sharing.

Read-only SQLite snapshot:
  python3 sqlite_snapshot.py app.sqlite selection.json data.json

selection.json contains only the selected table/column names and analysis rules:
  {"tables":{"orders":["id","total"]},"rules":[{"type":"required","table":"orders","field":"id"},{"type":"range","table":"orders","field":"total","min":0}]}

The database is opened read-only, using a consistent transaction. Views and virtual tables are rejected; table/column names are checked and quoted, with no arbitrary SQL accepted. Select at most 50 ordinary tables, 100 columns per table and 10,000 total rows. Large exports fail rather than silently truncating. The query has a ten-second execution budget and output is capped at 2 MB. Binary fields cannot be exported as JSON; omit them. Output must not exist. Selected values may contain private data: review before importing into Data Integrity Sentinel. PostgreSQL and other database engines are not supported by this collector.
