--- title: "FAQ · whatleaks" url: https://whatleaks.me/faq/ updated: 2026-10-23 --- > How to see what telemetry a CLI tool sends, whether DO_NOT_TRACK works, how to test an opt-out, what Next.js telemetry sends, whether whatleaks is safe, and how it compares with mitmproxy and HTTP Toolkit. > Source: https://whatleaks.me/faq/ · Repository: https://github.com/devanshranjan10/whatleaks FAQ # Questions, answered *directly*. About telemetry, opt-outs, and what whatleaks can and can't see. Every number links back to a measurement. ## What is whatleaks? whatleaks is a free, open-source command-line tool (npm package `whatleaks`, MIT licensed, by Devansh Ranjan) that runs a command through a local, single-run proxy and reports where its traffic went, how often, which fields each payload carried, and whether any of it is about you. `whatleaks compare` runs the command twice, with defaults and then opted out of telemetry, and shows what is still sent. It runs on macOS and Linux with Node 22.12 or later. Source: [github.com/devanshranjan10/whatleaks](https://github.com/devanshranjan10/whatleaks). ## How do I see what telemetry a CLI tool sends? Run it through whatleaks: `npx whatleaks run -- `, for example `npx whatleaks run -- npm run build`. When the command exits, whatleaks prints every destination, request counts, every payload field with redacted samples, and anything that identifies you or your machine. Known telemetry endpoints are labelled from a catalog of 69 hosts, each with a source link. The raw capture is saved as a HAR file only you can read. ## How do I check whether a tool's telemetry opt-out actually works? Use `npx whatleaks compare -- `. It runs the command twice in fresh processes: first with defaults (every known opt-out variable removed), then with all 32 documented opt-out variables set. It shows what was still sent, what stopped, and which ids stayed the same between runs. To test one switch: `whatleaks compare --no-known-opt-outs --off-env DO_NOT_TRACK=1 -- `. Add `--strict` to exit 1 in CI when a known telemetry endpoint is still contacted. ## Does DO\_NOT\_TRACK=1 turn off telemetry? Only in tools that implement it. In whatleaks's real-tool runs, Turborepo 2.11 and Wrangler 4.151 honoured `DO_NOT_TRACK=1`; Next.js 16.4.2 and Astro 7.4.1 kept sending, which matches their documentation, since neither documents `DO_NOT_TRACK` support. Next.js sent 8 telemetry requests with it set; its documented switch, `NEXT_TELEMETRY_DISABLED=1`, took that to 0. Set the tool's own variable, and check it with `whatleaks compare`. ## What does Next.js telemetry send? In a `next build` of a two-file app with Next.js 16.4.2 on Node 22.23, whatleaks captured 8 POST requests to `telemetry.nextjs.org/api/v1/record` carrying 22 events with 91 distinct fields. Each request carried three ids (`anonymousId` and `projectId` were identical in a second run; `sessionId` changed), the OS, CPU model, CPU count and speed, memory size, CI, Docker and WSL flags, the Next.js version, build configuration flags, and `meta.agentName`, the AI coding agent that ran the build. It sent none of the machine's own identifiers (username, hostname, home path, MAC address, machine id or git email). Full transcript: [docs/e2e](https://github.com/devanshranjan10/whatleaks/tree/main/docs/e2e). ## Can it tell whether an app sends my username, email or machine ID? Yes. whatleaks reads this machine's username, hostname, home path, MAC address, machine id and git email into memory, and searches every payload for them raw and as md5, sha1 and sha256 hex and base64. The report says what was found, how it was encoded and where it appeared. In the benchmark, all 8 planted identifiers were found in every run and none of the 4 decoys was flagged. It cannot recognise salted hashes. ## Is it safe? Does it install a certificate or change proxy settings? No to both. Each run generates a fresh certificate authority whose private key stays in memory; its certificate is written to a private temp folder that is deleted when the run ends. The proxy listens on 127.0.0.1 only. Trust and proxy settings reach only the app's own process tree, through standard environment variables and small runtime hooks. Nothing is installed in the system trust store and no system proxy setting changes. ## Does whatleaks send my data anywhere? No. whatleaks has no account, no telemetry and no update check. The only traffic leaving your machine is the app's own, forwarded by the proxy as it would have gone anyway. Captures stay on your disk as HAR files readable only by you, and the identifiers it searches for are read into memory and never written. ## How is it different from mitmproxy or HTTP Toolkit? Those are general-purpose interception proxies. whatleaks is built to answer "what does this command send, and does opting out work": it follows the app's whole process tree, hooks Node, Python and Ruby clients that ignore proxy settings, names connections that bypass the proxy, searches payloads for your identifiers, and diffs runs with and without opt-outs. In a lab with exact ground truth, it silently missed 3.4% of attempts on macOS, against 38% for mitmproxy 12.2.3 given the same environment and 67% for HTTP Toolkit server 1.27.3 with its own interception. On real tools it matched 5 of 5 against their debug output; HTTP Toolkit 4, mitmproxy 3. Details: [the benchmark](https://whatleaks.me/benchmark/). ## Can it read traffic from apps that pin certificates? No, by design. An app that refuses the run's CA, such as one that pins certificates, fails that request. whatleaks lists the host by name with a count, under "not visible", and does not try to get around pinning. Go programs on macOS also refuse it, because they read only the system keychain. ## Does it work with Go, Rust or other native programs? Their HTTP traffic is captured when they honour the standard proxy variables and trust the CA (Go on Linux reads `SSL_CERT_FILE`; Go on macOS refuses the CA and is named, not read). Connections that bypass the proxy are found by polling the process's sockets: `netstat` on macOS, `/proc` on Linux. Very short ones can be missed: a Go connection reset within about 10 ms was caught 10 to 30% of the time in the lab, and UDP sent with `sendto()` is never seen. These are the only misses in the benchmark. ## Does it work on Windows? Not yet. Windows has no process-watching backend and is untested. macOS and Linux are benchmarked, and Linux also works in slim containers with no `ps`, `lsof` or `netstat`. ## Can I analyse a HAR file from another tool? Yes: `whatleaks report capture.har`, and `whatleaks diff before.har after.har` to compare two. The reader handles browser-devtools-style and mitmproxy-style HAR, including WebSocket messages. It was tested with hand-made samples, not real exports from Proxyman, Charles or HTTP Toolkit. ## Is it safe to share a whatleaks report? Reports are redacted by default: your identifiers become labels such as `‹home›`, secret-looking values become `‹redacted›`, emails become `‹email›`, and ids become per-report aliases such as `‹id-1›`. Redaction is pattern-based, so read a report before you post it. Share the report, never the HAR file: that holds the raw traffic and is never redacted. ## Can I use it in CI? Yes. `whatleaks compare --strict -- ` exits 1 when a known telemetry endpoint is still contacted after opting out, or when the second run did not exit cleanly, so a build fails if a tool stops honouring its switch. `--md` and `--json` write the result to a file for the job's artifacts.