Data, privacy, and network access for the JetBrains plugin

This page lists what the plugin sends to CodeRabbit, which hosts it connects to, and what it keeps on your computer. For how CodeRabbit handles your code after it arrives, see How CodeRabbit uses your code.

​

What a review sends

When you start a review, the plugin sends:

• For each file in the scope: its path, diff, and current content, whether it’s new, renamed, or deleted, its previous path if renamed, and its added and removed line counts. Some files are sent without content; see What gets reviewed.
• The .coderabbit.yaml or .coderabbit.yml file from the root of the Git repository, if there is one, even when it hasn’t changed.
• The name and URL of each Git remote, with any credentials, query string, and fragment removed.
• The commit hashes of your branch and the base, and the base branch name.
• Your CodeRabbit user ID, username, email address, Git provider user ID, and organization ID. If your account has no username or email address, the plugin uses user.name and user.email from your Git configuration.
• The plugin version.

Signing in and loading your account also contact CodeRabbit, but they don’t send code. Fix with AI sends nothing to CodeRabbit.

​

Keep secrets out of reviews

• New files that Git ignores through .gitignore are never sent. Files that Git tracks are sent whatever .gitignore says.
• Unlike the VS Code extension, the plugin has no built-in list of files to skip, such as keys, certificates, or Terraform state. Any tracked file in the scope is sent.
• To leave files out, use the Review all uncommitted files scope and clear their checkboxes, or set a Scope directory; see Choose what to review.
• Path filters apply on CodeRabbit’s side, after the files are sent, so they don’t keep a file from being sent.
• Keep secrets out of tracked files in the first place, for example with a secret scanner in your pre-commit hooks or CI.

​

How CodeRabbit uses your code

IDE reviews follow the same data handling as other CodeRabbit reviews. CodeRabbit never uses customer code for model training, and your organization’s data retention setting controls whether CodeRabbit stores code-related data. For details, see Data security, Caching, and the CodeRabbit Privacy Policy.

​

Network access

The plugin connects to these hosts over port 443. The last column says which machine connects in Remote Development; without it, everything runs on your computer. During sign-in, your browser also sends the result to the IDE at http://127.0.0.1 on a random local port, on your computer. Local firewalls and browser policies must allow that address. The plugin has no proxy settings of its own. It connects through the proxy set in the IDE’s HTTP Proxy settings; in Remote Development, set it in the host IDE, which makes the connections to CodeRabbit. Proxies that require authentication may not work during the beta. If your network inspects TLS traffic, the IDE that connects to CodeRabbit must trust your organization’s certificate, for example through Settings → Tools → Server Certificates.

​

Data stored on your computer

The plugin stores this data on the machine that runs the IDE; in Remote Development, your sign-in and saved reviews are on the remote host. The workspace file sits inside the project, so check that your backups and version control treat .idea/workspace.xml the way you want.

​

Usage analytics and error reports

The plugin sends two kinds of events to CodeRabbit:

• Usage analytics are off until you turn them on, with Share usage analytics when you sign in or Share product usage analytics with CodeRabbit in Settings → Tools → CodeRabbit. They record actions such as installing the plugin, signing in, applying a suggestion, sending findings to an agent, and selecting View plans.
• Error and failure reports are always sent when Deployment is United States or European Union, and there’s no setting to turn them off. They record which operation failed, such as a review or a sign-in, and a general reason.

Both kinds of events include your account details when you’re signed in (email address, user ID, username, Git provider user ID, and organization ID), the plugin version, and a random ID for your installation. They never include source code, file paths, finding text, or prompts. Both go to CodeRabbit through the app host of your deployment, app.coderabbit.ai or app.eu.coderabbit.ai, which sign-in also uses, so you can’t block them by host without blocking sign-in.

​

Remove local data

• Saved reviews: choose Clear local review history… from the tool window’s Options menu (⋮). Repeat it in each repository.
• Sign-in: select Sign out in the tool window. This removes the stored sign-in from the IDE; it doesn’t end the session on CodeRabbit’s side.
• Fix with AI prompts: if an agent exited with an error, delete any leftover coderabbit-fix-*.txt files from the system’s temporary folder; in Remote Development, that’s on your computer.
• Settings and the plugin: uninstall the plugin; see Update, roll back, or uninstall. Uninstalling doesn’t remove saved reviews or the stored sign-in, so clear and sign out first.

​

What’s next