Data and IBM Bob

• A Recorded example run on this site sends nothing to IBM Bob. Bob's answers are replayed from a saved real run.
• A Live run, with the CLI on your machine and your own key, sends repo content and run data to IBM Bob as prompts.
• Your IBM Bob key stays on your machine. The hosted site never asks for it.
• The engine sends HTTP requests only to your sandboxed app, never anywhere else.

Only in a live run, and only when Roook calls a Bob agent: to understand the repo, propose and review rules, design scenarios, diagnose a counterexample, write and review a fix, or answer a question you ask the Guide. Each call starts IBM Bob Shell on your machine with a prompt Roook built.

• The engine's work never calls Bob: the search, the shrinking, the replays and the four verification checks are plain code talking to your app.
• rook replay, rook verify and rook explain never call Bob.
• In a recorded run no Bob process is started at all. Every recorded run is labelled Recorded example run, and every run with real Bob calls is labelled Live run.

Roook hands the prompt to IBM's software and service. What IBM does with it is governed by your agreement with IBM, not by Roook.

A listing of the repo

The path, size and content hash of up to 400 files, so the Scout knows what exists.

Files Roook picks

Build and manifest files at the repo root (such as Dockerfile, compose files, requirements.txt, pyproject.toml, package.json, go.mod, .env.example and README.md), the route and model files the Scout named, and up to 4 source files related to a broken rule. Each file is cut at 20,000 characters and one prompt carries at most 120,000 characters of files.

Files Bob opens itself

Bob's agents have a read tool over the run's workspace copy of your repo, so treat every file in that copy as readable in a live run.

Run data

The model (actions, state readers, rules), a counterexample's steps and observed values, your app's HTTP responses and state during a replay, and the tail of your app's logs.

What you type

Your request for the run, and any question you ask the Guide.

The workspace copy leaves out .git, .venv, venv, node_modules and tool caches. Everything else in the folder is copied, tracked by git or not.

• Your shell's environment. The Bob process gets only a short allowlist of variables (PATH, HOME, locale and temp-folder settings) plus BOB_API_KEY. Nothing else from your environment reaches it.
• Your key inside a prompt. The key is how Bob Shell signs in to IBM; Roook never writes it into a prompt, a command-line argument, an event or a log.
• Anything outside the workspace copy. Bob runs in the copy, links that point outside it are removed when the copy is made, and the agents have no command, browser or MCP tools.
• Tokens and passing values in your app's output. Before app data and logs go into a prompt, Roook replaces tokens, credentials, timestamps and random ids with labels. Log text also goes through the redaction filter, which removes known secret values, PEM key blocks, bearer tokens, IBM Bob keys, GitHub tokens and JWTs.
• Your app's database or files in the sandbox. Bob sees only what your API returned and what your app logged.

The same redaction filter cleans every event and log line Roook stores or shows, so a key that appears in output is replaced before it is saved.

• On your machine, in the BOB_API_KEY environment variable of the shell that runs Roook. The install guide suggests a file only you can read.
• In the Bob Shell process Roook starts, through its environment only.
• In GitHub Actions, in a repository secret you create. The action masks it and gives it only to the step that runs Roook, and only in live mode.
• Never on the hosted site. The site's example runs use recorded answers, and no page or form asks for your key. If something claiming to be Roook asks for it in a browser, do not enter it.

• Setting up the key

~/.rook/workspaces/

The copy of your repo each run worked on, with the model, counterexamples, tests and fix branches. Roook does not delete these; remove them when you no longer need them.

~/.rook/recordings/

Bob's saved answers, only if you turn recording on by setting ROOK_BOB_MODE to record. Recordings can contain parts of your repo, so keep them private.

~/.rook/credentials.json

Your Roook sign-in, only if you ran rook login, readable only by you. rook logout revokes the session and deletes the file.

Only if you connect GitHub. The Roook GitHub App asks for the least it needs to clone a repo and open a pull request:

• Contents: read and write.
• Pull requests: read and write.
• Metadata: read.

• The Roook server keeps your installation id. The list of your repos is read from GitHub when needed.
• Tokens are short-lived installation tokens, made for one repo at a time, kept in memory and never written to disk, logs or events.
• The App's private key is only on the Roook server. Webhooks from GitHub are checked with a signature before they are read.
• Roook never pushes to your default branch: a fix goes to a rook/fix-* branch and a pull request.

• For each run: who owns it (your account id, or a guest cookie id), the repo, the status, times and Bob coins, its event log with secrets redacted (this includes the request text you typed), and its counterexamples.
• If you link GitHub: your account id, email and installation id.
• For guests: a daily run count, kept by guest cookie id and by client IP address.
• No analytics, ads or tracking scripts, on the site or in the app.

• Runs older than 30 days are deleted automatically, with their events and counterexamples. Guest run counts older than 2 days are deleted too.
• You can delete a run yourself: open it in the web app and use Delete run. Its events and counterexamples go with it.
• Signed in, you can delete all your Roook server data, your runs and your GitHub link, with Delete my data in the account menu. You are then signed out.
• Your sign-in account itself is held by Supabase, the sign-in service. The Roook server cannot delete it, so it is deleted on request by email.

Email aayush@roook.dev

• Security: how data and code are handled
• Privacy