Where your data goes
Nowhere. There is no server here. This page is static files, and the scan runs inside your own browser, so no repository content, URL or report reaches any machine this project operates — there is no such machine to reach.
The page talks to exactly three hosts, all from your browser:
cdn.jsdelivr.net— the pinned Python runtime, compiled to WebAssembly.api.github.com— one request, to list a repository's files.raw.githubusercontent.com— the files themselves.
Nothing is stored between visits beyond your browser's ordinary cache of those downloads.
What it detects
- Uses of CPython APIs that are deprecated or removed in a release you are moving toward.
- Imports and attribute references, including aliased ones, resolved to their real target.
- The version each change lands in, so you can see what is urgent and what is merely coming.
What it cannot see
- Private repositories. This page is unauthenticated, so it reads public source only. The command-line tool has no such limit.
- Whole large repositories. Files are fetched one by one under a cap. A scan that hits a cap says so, prominently — an incomplete scan is never presented as a clean one.
-
Anything that only exists at runtime. PyAhead is a
static analyser. A call reached only through
getattror a plugin registry is invisible to it, and it says so rather than guessing. - Your dependencies. The scan covers the source in the repository, not the libraries it installs.
- Whether the code runs at all. A finding is a reference to something that changed, not proof that line executes.
The full limitations are in the usage documentation, and the boundaries the tool keeps are in security and privacy.
When to use the command line instead
This page exists to remove the install step from a first look. For anything continuous — private code, a scan on every push, a gate in CI — install the tool:
$ pip install pyahead
$ pyahead check .
Requirements
A browser with WebAssembly, which means any current one, and a few megabytes of download the first time you scan. The runtime stays cached afterwards.